CVE-2026-73328— Volmarg Personal Management System through 2.1.0 Unrestricted File Upload RCE via /upload/send/

Quick assessment

Affected

volmarg personal-management-system

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Volmarg 个人管理系统（版本 2.1.0 及以下）存在不受限制的文件上传漏洞。已认证用户可通过接口上传 PHP 文件。攻击者可提交以为扩展名、经 Base64 编码的，将其写入 Web 根目录，并请求服务器以 Web 服务用户的身份执行该代码。

CVSS 7.2 · High Updated Nov 03, 2026

Possible ATT&CK Techniques 2 AI

T1059.007 · JavaScript T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Volmarg Personal Management System through 2.1.0 Unrestricted File Upload RCE via /upload/send/

Source: CVE Program / CVE List V5

Vulnerability Description

Volmarg Personal Management System through 2.1.0 contains an unrestricted file upload vulnerability that allows authenticated users to upload PHP files via the /upload/send/ endpoint. Attackers can submit base64 fileContent with a .php fileName into the web root and request it to execute code as the web server user.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

危险类型文件的不加限制上传

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
volmarg	personal-management-system	0 ~ 2.1.0	-

II. Public POCs for CVE-2026-73328

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-73328

请登录查看更多情报信息。

Other References for CVE-2026-73328 (1)

GitHub - Volmarg/personal-management-system: Your web application for managing personal data. personal.management.system.inbox@gmail.com product

Other References for CVE-2026-73328 (6)

https://github.com/Volmarg/personal-management-system/blob/v2.1.0/src/Services/Files/Upload/FileUploadService.php#L57-L67 technical-description
https://github.com/Volmarg/personal-management-system/blob/v2.1.0/src/Services/Files/Upload/FileUploadValidator.php#L57-L81 technical-description
https://github.com/Volmarg/personal-management-system/blob/v2.1.0/src/Action/File/UploadedFileAction.php#L56-L83 technical-description
https://github.com/Volmarg/personal-management-system/blob/v2.1.0/src/Services/Files/Upload/FileUploadConfigurator.php#L117-L129 technical-description
https://github.com/Volmarg/personal-management-system/issues/167 issue-tracking
https://www.vulncheck.com/advisories/volmarg-personal-management-system-through-2.1.0-unrestricted-file-upload-rce-via-upload-send third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-73328

IV. Related Vulnerabilities

Same product: personal-management-system

Same vendor: volmarg

Same weakness: CWE-434