CVE-2026-107356

U.S. Geological Survey Area Species Management Research Program ARMI accepts any uploaded file and stores the file under '/uploads/upload-file'. A remote, authenticated attacker could upload a crafted PHP file that executes and returns command output from the server when accessed. Fixed on...