CVE-2026-73328

Name of the Vulnerable Software and Affected Versions Volmarg Personal Management System versions prior to 2.1.1

Description Authenticated users can upload PHP files through the '/upload/send/' endpoint. By submitting base64 encoded fileContent with a .php fileName into the web root, an attacker can execute arbitrary code with the privileges of the web server user.

Recommendations Update Volmarg Personal Management System to a version newer than 2.1.0. Restrict access to the '/upload/send/' endpoint to minimize the risk of exploitation.