CVE-2026-67688

The ICS-Park Smart Park Management System v2.0 is vulnerable to an unrestricted file upload in the file upload module. The root cause is that the DEFAULT_ALLOWED_EXTENSION whitelist permits .html and .htm extensions while the upload directory is mapped as a static resource path. This allows an au...