Unrestricted Upload Vulnerability in onetwothreeneth HospitalManagementSystem

CVE-2026-104637

What is CVE-2026-104637?

A vulnerability has been identified in the onetwothreeneth HospitalManagementSystem, where the functions responsible for managing patient and physician data suffer from an unrestricted file upload issue. This weakness resides in the php/controller.php file, particularly within the functions add_patient, add_physician, add_account, update_account, update_subaccount, edit_physician, and edit_patient. Malicious entities can exploit this flaw by manipulating the img argument, potentially allowing remote attackers to upload unauthorized files. Despite early notification of this issue, the project has not provided any updates or patches, leaving deployments susceptible to exploitation. Continuous delivery practices mean that version tracking can be challenging, and users are encouraged to assess their exposure promptly.

References