CVE-2025-4912 is a medium severity path traversal flaw (CVSS 5.4) in SourceCodester Student Result Management System 1.0. The old_photo argument of /admin/core/update_student.php is not restricted to its intended folder. The record names no fixed version, so limit access and fix the code.
What's affected
The record lists Student Result Management System 1.0 from SourceCodester, in the image file handler of /admin/core/update_student.php. The argument is old_photo. The record says the issue can be reached remotely and that the exploit has been disclosed publicly.
The title of the linked write-up refers to an arbitrary file delete in update_student. I could not load that page, so I cannot describe it beyond its title. The record does not name a patched version and I found no vendor fix. Check the vendor site before assuming one exists.
How to check if you're exposed
Search your web roots for the application and the file:
find /var/www -name "update_student.php" -path "*admin/core*" 2>/dev/null
Then read how the file uses old_photo. A safe version restricts the name to a plain file name, resolves the full path, and confirms the result sits inside the photo upload directory before it deletes anything. If the value from the request is joined onto a path and passed straight to a delete call, the application has the weakness.
grep -n "old_photo" /var/www/html/admin/core/update_student.php
grep -n "unlink" /var/www/html/admin/core/update_student.php
The CVSS vector lists low privileges required, so a signed in user account is probably enough. Check how many accounts exist and who can create them.
What to do now
- Find every installation of the application, including copies running on school or training servers.
- Take it off the public internet, or restrict it with a VPN or an IP allow list.
- Change the code so that the photo name is validated, the path is resolved, and deletion only happens inside the upload folder.
- Make sure the web server account cannot write or delete outside the directories the application needs.
- Keep backups of the application folder and database, since a flaw that deletes files can remove code and configuration.
Why it matters
The weakness is path traversal, filed as CWE-22. The application trusts a path supplied by the user and uses it for a file operation. Special sequences in the value can then point the operation at files outside the folder the developer had in mind.
The record rates the impact as none for confidentiality and low for integrity and availability. In a deletion case, the practical damage depends on what the web server account may remove. A student results system holds records that the school needs to keep, so backups matter more than the score suggests. This CVE is not on the CISA Known Exploited Vulnerabilities list.
Quick check
Do I need to be an administrator to trigger it?
The vector lists low privileges required, so a regular account may be enough. Confirm against your own installation.
Is there a vendor patch?
The record names none and I found none. Fix the path handling yourself and keep the application off the open internet.
Sources
- Write-up referenced by the CVE record (page did not load without JavaScript)
- VulDB entry referenced by the CVE record
Last reviewed: 18 October 2026.
