CVE-2026-107356

The U.S. Geological Survey Area Species Management Research Program (ARMI) is vulnerable to an unrestricted file upload (CWE-434) flaw. A remote, authenticated attacker can upload a crafted PHP file , which the system stores under the /uploads/{upload-file} directory. When accessed, this file exe...