CVE-2026-107356
HIGH
NVD
CVSS Score
8.8
Severity
HIGH
Published
Nov 10, 2026
Vendor
unknown
Description
U.S. Geological Survey Area Species Management Research Program (ARMI) accepts any uploaded file and stores the file under '/uploads/{upload-file}'. A remote, authenticated attacker could upload a crafted PHP file that executes and returns command output from the server when accessed. Fixed on 2026-07-20.