CVE-2026-36722

The BookCars car rental management platform (v8.3) contains an authenticated arbitrary file upload vulnerability within the /api/create-car-image component. An attacker with authentication can upload a specially crafted file to execute arbitrary code on the server. Exploitation details are not pr...