Unrestricted Upload Vulnerability in gedelumbung HospitalManagement KCFinder File Manager
CVE-2026-102842

5.3MEDIUM

Key Information:

Vendor: Gedelumbung
Status: Hospitalmanagement
Vendor: CVE Published:; 30 September 2026

🔔 Create Gedelumbung Vulnerability Alert

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-102842?

A vulnerability has been discovered in gedelumbung HospitalManagement that allows for unrestricted file uploads via the KCFinder File Manager. This issue arises specifically within the function app_user_login_model.php::cekUserLogin. By manipulating the ADMIN_RS_KCFINDER argument, attackers can gain unauthorized access to upload files directly to the server, potentially leading to significant exploitation risks. The vulnerability affects all versions of the software up to c2d45543789a3887067d3915f69d44cfc2cf76a8, and while details on future updates are patchy due to the rolling release strategy, the developers have not yet issued a formal response to the reported issue.

Affected Version(s)

HospitalManagement c2d45543789a3887067d3915f69d44cfc2cf76a8

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-102842 - Proof of Concept