GitHub Advisoryadvisory · Packagist

GHSA-rm34-fg4m-39mw OpenSTAManager contains an arbitrary file upload vulnerability in its module update functionality

HIGH Published 2026-05-04 Modified 2026-05-08 Official page ↗
Aliases
CVE-2026-38751
Ecosystem
Packagist
Packages
devcode-it/openstamanager
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-434
Reviewed
2026-05-08

Affected packages

• Packagist devcode-it/openstamanager: <= 2.10-beta (no fix yet)

Description

OpenSTAManager versions 2.10 and earlier contain an arbitrary file upload vulnerability in the module update functionality (modules/aggiornamenti/upload_modules.php).

Related

Alias · CVE (1)

  • CVE-2026-38751 OpenSTAManager version 2.10 and earlier contains an arbitrary file upload vulnerability in the module update functionality… vulnerability

Weakness · CWE (1)

  • CWE-434 Unrestricted Upload of File with Dangerous Type weakness

References