CVE-2026-94837
TOCTOU in file upload writes the file before validating its extension
| CVE | CVE-2026-94837 |
|---|---|
| Status | RESERVED |
| Product | SubMgr |
| Affected | all versions through 3.42 |
| Fixed | commit 658d46c8 (inc_common.php:1567) |
| CWE | CWE-434, CWE-367 |
| CVSS 3.1 | 7.5 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) — researcher-assigned |
| Discoverer | David Kutz-Marks (@davidkm-ai) |
| Full chain write-up | chains/SUBMGR.md |
Detail
upload() at inc_common.php:1708 moves the file into the upload directory first and form_check() validates the extension second. On rejection exit_error() fires and the file remains on disk, cleaned up only if the same session uploads again.
The name is temp_<unix_timestamp>_<attacker_chosen_name>.php, and the timestamp comes from the HTTP Date response header — both halves known. Reachable unauthenticated via the public submission form at main_home.php:30.
Exploitation requires upload_path to be web-accessible; the documentation recommends otherwise but does not enforce it.
Remediation
See chains/SUBMGR.md for the full remediation section, including operator
hardening that applies regardless of version.
References
- Chain write-up:
chains/SUBMGR.md - Machine-readable record: github.com/davidkm-ai/advisories/blob/main/CVE-2026-94837.md
Want this depth on your own systems?
DKM Security does the same work against client infrastructure, under scope and under contract.
Get In Touch