CVE-2025-2687 is a Medium severity (CVSS 6.3) unrestricted file upload in PHPGurukul eLearning System 1.0, in the image handler of /user/index.php. The record names no fixed version, so restrict uploads and check the vendor site for a patch. Until then, block script execution in the upload folder.
What's affected
The record lists one affected release: PHPGurukul eLearning System version 1.0, component Image Handler, file /user/index.php. It names no patched version.
PHPGurukul projects are distributed as source code that people deploy themselves, so there is no package feed to watch. Your exposure depends on whether you installed this project and kept it reachable.
The CVSS vector requires a low privilege account (PR:L), meaning a logged in user. That is why the score is Medium and not High, but a learning platform often allows open registration, which can make that precondition easy to meet.
How to check if you're exposed
There is no package to query. Check the file system and your upload directory.
find /var/www -type f -path "*user/index.php" 2>/dev/null
Then look at where uploaded images are stored and whether anything other than images is there. Unexpected script files in an upload directory are the thing to look for.
find /var/www -type f \( -name "*.php" -o -name "*.phtml" \) -path "*upload*" 2>/dev/null
If your web server is configured to run scripts from the upload path, any file placed there could run. Check the server configuration for the directory too. Also review the access log for requests to the image upload function.
What to do now
- Find every deployment of the eLearning System and note whether it allows self registration.
- Disable script execution in the directory that stores uploads, at the web server level.
- Check the upload directory for files that are not images and investigate any you find.
- Look for an updated release on the vendor site. The record does not confirm one.
- If you maintain the code, validate file type by content, rename files on upload and store them outside the web root.
- Limit who can reach the application until the handler is fixed.
Why it matters
The record lists CWE-284 (improper access control) and CWE-434 (unrestricted upload of dangerous file types). The core problem is that the handler accepts a file without confirming it is the kind of file it expects. If the server will execute an uploaded script, an image feature becomes a way to run code.
The scored impact is low across confidentiality, integrity and availability, which is why this is rated Medium. Real impact depends on server settings, since upload bugs are far worse where uploaded files can be run. The record says the exploit has been disclosed publicly. The record's KEV flag is false, so it is not in the CISA Known Exploited Vulnerabilities catalog.
Defending against this class of bug is mostly about configuration: store uploads where scripts cannot run, and do not trust the file name or the declared type.
Quick check
Can I fix this without a vendor patch?
If you can edit the code, yes: check content type, rename uploads and keep them out of the executable path. Also block script execution in the upload directory.
Is it a Critical issue?
No. The record scores it 6.3, Medium, although the description uses the word critical in the reporting database's own wording. The score is the figure to use for prioritisation.
Sources
Last reviewed: 19 October 2026.
