NVD security advisoryHigh
High advisory for Volmarg Personal Management System throu
CVE-2026-73328 · Reported 3 Nov 2026
Full advisory details, affected packages, severity context, and original source.
Affected technology
Volmarg Personal Management System throuPHP ecosystem
Advisory overview
Volmarg Personal Management System through 2.1.0 contains an unrestricted file upload vulnerability that allows authenticated users to upload PHP files via the /upload/send/ endpoint. Attackers can submit base64 fileContent with a .php fileName into the web root and request it to execute code as the web server user.
Related references
- https://github.com/Volmarg/personal-management-system
- https://github.com/Volmarg/personal-management-system/blob/v2.1.0/src/Action/File/UploadedFileAction.php#L56-L83
- https://github.com/Volmarg/personal-management-system/blob/v2.1.0/src/Services/Files/Upload/FileUploadConfigurator.php#L117-L129
- https://github.com/Volmarg/personal-management-system/blob/v2.1.0/src/Services/Files/Upload/FileUploadService.php#L57-L67
- https://github.com/Volmarg/personal-management-system/blob/v2.1.0/src/Services/Files/Upload/FileUploadValidator.php#L57-L81
- https://github.com/Volmarg/personal-management-system/issues/167
- https://www.vulncheck.com/advisories/volmarg-personal-management-system-through-2.1.0-unrestricted-file-upload-rce-via-upload-send