{"id":"CVE-2026-107356","published":"2026-11-10T22:18:14.577","lastModified":"2026-11-10T22:18:14.577","description":"U.S. Geological Survey Area Species Management Research Program (ARMI) accepts any uploaded file and stores the file under '/uploads/{upload-file}'. A remote, authenticated attacker could upload a crafted PHP file that executes and returns command output from the server when accessed. Fixed on 2026-07-20.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-434"],"vendors":[],"products":[],"references":[{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-313-01.json","tags":[]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-107356","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}