CVE-2026-107356— U.S. Geological Survey Area Species Management Research Program unrestricted file upload

Quick assessment

Affected

U.S. Geological Survey Area Species Management Research Program

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

美国地质调查局（USGS）区域物种管理研究计划（ARMI）接受任何上传的文件，并将文件存储于路径下。远程认证攻击者可上传特制的 PHP 文件，当该文件被访问时，会在服务器上执行并返回命令输出。该漏洞已于 2026 年 7 月 20 日修复。

CVSS 8.8 · High Updated Nov 11, 2026

Possible ATT&CK Techniques 3 AI

T1190 · Exploit Public-Facing Application T1059 · Command and Scripting Interpreter T1105 · Ingress Tool Transfer

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

U.S. Geological Survey Area Species Management Research Program unrestricted file upload

Source: CVE Program / CVE List V5

Vulnerability Description

U.S. Geological Survey Area Species Management Research Program (ARMI) accepts any uploaded file and stores the file under '/uploads/{upload-file}'. A remote, authenticated attacker could upload a crafted PHP file that executes and returns command output from the server when accessed. Fixed on 2026-07-20.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

危险类型文件的不加限制上传

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
U.S. Geological Survey	Area Species Management Research Program	0 ~ 2026-07-20	-

II. Public POCs for CVE-2026-107356

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-107356

请登录查看更多情报信息。

Other References for CVE-2026-107356 (2)

https://www.cve.org/CVERecord?id=CVE-2026-107356 vdb-entry
https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-313-01.json third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-107356

IV. Related Vulnerabilities

Same weakness: CWE-434