CVE-2025-10480 is a medium severity unrestricted file upload flaw (CVSS 6.3) in SourceCodester Online Student File Management System 1.0. The weakness sits in /save_file.php. The record names no fixed version, so block the endpoint, restrict what the server will accept and execute, and scan your dependencies.
What's affected
The record lists SourceCodester Online Student File Management System 1.0. The affected file is /save_file.php, and the vulnerable input is the uploaded file.
No fixed version appears in the record. I could not confirm a patched release from the sources available, so check the SourceCodester site and the referenced report before assuming a fix exists. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, which means network reachable, low complexity, no user interaction, and low privileges required, typically a logged in account.
How to check if you're exposed
First confirm the application is installed and the upload script exists. Then look at what the script does with the uploaded file:
find /var/www -name "save_file.php" 2>/dev/null
grep -n "move_uploaded_file" $(find /var/www -name "save_file.php")
Also list the upload directory and look for files that are not images or documents, such as scripts. Review web server access logs for requests to the endpoint from addresses you do not recognize.
You can also paste your dependency manifest into the free in-browser scan at gold.safeguard.sh/scan. It will not find an application like this one if you installed it as a standalone folder, so inventory it by hand.
What to do now
- Disable or restrict
/save_file.phpuntil the upload handling is corrected. - Accept only an allowlist of file types, check the content and not just the extension, and rename files on save.
- Store uploads outside the web root, or configure the upload folder so the server never executes files from it.
- Review the upload folder for unexpected files and remove them after preserving copies for analysis.
- Check the vendor site and referenced report for a patch, and apply it if one exists.
Why it matters
This is CWE-434, unrestricted upload of a file with a dangerous type, together with CWE-284, improper access control. When a server accepts any file and stores it somewhere it can be fetched or run, the upload feature becomes a way to place code on the host.
The usual defenses are an allowlist of types, content checks, storing files outside the web root and denying execution in upload folders. The record does not flag this CVE as a CISA Known Exploited Vulnerability, so there is no confirmation here that it is exploited in the wild.
The record says the exploit has been made public. That describes published detail, not observed attacks.
Planning for software with no vendor fix
When no patched version is named, you have three options: fix it yourself, shield it, or retire it. Fixing it yourself works well for small PHP applications, since the change is usually one query. Shielding means network controls and a firewall rule. Retiring means moving to a maintained alternative.
Whichever you choose, write the decision down with an owner and a review date. Unpatched software tends to be forgotten rather than decided on. Continuous monitoring of your inventory against new advisories makes sure a fix, if one appears later, does not slip past you.
Quick check
Is there a fixed version of Online Student File Management System?
The record lists none. Check the SourceCodester site and the referenced report. Until then, restrict the endpoint and fix the code yourself.
Is this being exploited in the wild?
The record does not flag it as a CISA KEV entry. It does say the exploit has been published, so assume attackers can reproduce it.
Sources
- Safeguard Gold entry for CVE-2025-10480
- NVD record for the CVE, as supplied in the Safeguard CVE feed
- The links below come from that record. Several could not be opened when this post was reviewed, so confirm details with the vendor.
- https://github.com/ganzhi-qcy/cve/issues/26
- https://www.sourcecodester.com/
- https://vuldb.com/?ctiid.323915
- https://vuldb.com/?id.323915
Last reviewed: 19 October 2026.
