HIGH7.2

GHSA-rm34-fg4m-39mw

OpenSTAManager contains an arbitrary file upload vulnerability in its module update functionality

Details

OpenSTAManager versions 2.10 and earlier contain an arbitrary file upload vulnerability in the module update functionality (modules/aggiornamenti/upload_modules.php).

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/devcode-it/openstamanager

Introduced in: 0

No fixed version published yet for devcode-it/openstamanager (composer). Pin to a known-safe version or switch to an alternative.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-38751[ADVISORY]
https://github.com/devcode-it/openstamanager[PACKAGE]
https://github.com/fuutianyii/poc[WEB]