CVE-2025-1598 is a medium severity unrestricted file upload flaw in SourceCodester Best Church Management Software 1.0. The upload through the photo1 argument in /admin/app/asset_crud.php does not limit what files are accepted. NVD scores it 6.3. The record names no patch, so restrict uploads and restrict access.
What's affected
The record lists Best Church Management Software 1.0 from SourceCodester. The weak area is the photo1 argument in /admin/app/asset_crud.php. No fixed version is named in the record or in the references we could read. The record says the vendor was contacted early about this disclosure but did not respond in any way.
How to check if you're exposed
Find the upload folder and look at what it holds.
find /var/www -type d -ipath "*upload*" 2>/dev/null
find /var/www -type f \( -name "*.php" -o -name "*.phtml" \) -ipath "*upload*" 2>/dev/null
Any script file inside an upload folder is a red flag and should be examined. Then confirm that the web server does not run scripts from that folder.
The vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) shows the attack needs a low privilege account. Check who has access to the feature, and review recent uploads.
What to do now
- Find every copy of the application and its upload folders.
- Stop the web server from executing scripts in upload folders, using server configuration.
- Accept only the file types you need, check content as well as the extension, and store uploads outside the web root with generated names.
- Review existing uploads for script files or other unexpected content, and remove anything you cannot explain.
- Restrict the feature to trusted users and networks until the code is fixed.
- Watch for a vendor fix, and plan replacement if none arrives.
Why it matters
The weakness is CWE-434, unrestricted upload of a file with a dangerous type, with CWE-284, improper access control, also listed. The application accepts a file and stores it where the web server can reach it, without checking what kind of file it is.
If a script file lands in a folder where the server runs scripts, uploading becomes running code. The score here is 6.3, and the impacts are low, but the real outcome depends on server settings. It is not on the CISA KEV list.
Going further
Upload handlers are among the most reused pieces of code in small web apps, and a single weak one tends to be copied into several pages. Search the codebase for every place that accepts files, not only the one in this CVE.
Storing uploads outside the web root removes a whole class of problem, since the server never serves them as code. Serve them back through a script that checks the type and sets safe headers.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is there a fixed version?
The record does not name one. Check the vendor site and fix the upload logic in your own copy.
What is the fastest safe mitigation?
Stop the server running scripts from upload folders, then restrict who can use the feature. Both are configuration changes you can make in minutes.
Sources
Last reviewed: 19 October 2026.
