CVE-2026-0643 is an unrestricted file upload flaw in projectworlds House Rental and Property Listing 1.0, in the sign-up page. NVD scores it 7.3, high severity, and says an exploit is public. No fixed version is listed, so validate uploads in your copy or take the app offline.
What's affected
- Product: House Rental and Property Listing 1.0 from projectworlds.
- Component: /app/register.php with action set to reg, the image argument on the sign-up form.
- Fixed version: none listed in the CVE record. Check the vendor for a newer release.
- Severity: CVSS 7.3, vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. No privileges are required, so anyone who can reach sign-up can reach the upload. - Exploitation: the record says an exploit is public. It is not on the CISA KEV list.
How to check if you're exposed
This is source code you host, so first find out whether you run it, and whether the upload folder can run scripts.
find /var/www -type f -path "*app/register.php" 2>/dev/null
# List what has been uploaded, newest first
find /var/www -type f -newer /var/www -path "*upload*" -ls 2>/dev/null | head -50
Look for files in the upload folder that are not images, especially anything ending in .php, .phtml or .phar. If you find any, treat the server as compromised and start an incident process before cleaning up.
What to do now
- Take the sign-up page offline, or require an invitation, until the upload is fixed.
- Check the vendor site for a newer release. The record names none.
- In your copy, accept only the image types you need, check the file content and not just the extension, and rename uploads to random names on save.
- Store uploads outside the web root, or configure the web server so the upload folder never executes scripts.
- Review the upload folder and web logs for unexpected files and requests to them, and rotate any credentials stored on the server if you find one.
Why it matters
The weakness is CWE-434 (unrestricted upload of a file with a dangerous type), together with CWE-284 (improper access control). The sign-up page accepts an image field and does not limit what kind of file arrives.
Upload bugs are serious on PHP hosts because a file that lands in a web folder can be run by the server if the folder allows it. The CVSS vector for this record lists limited impact on confidentiality, integrity and availability, but the real outcome depends on how your server treats the upload folder. That is the setting to check first. The public report was a GitHub issue I could not retrieve, so this post relies on the CVE record.
Quick check
Why check the upload folder settings and not only the code?
Because the same file is harmless if the server never runs it. Blocking script execution in the upload folder limits the damage even when validation is weak.
Is there a patch for CVE-2026-0643?
The CVE record lists no fixed version. Check the vendor, and fix the upload handling yourself if you keep running the app.
Sources
Last reviewed: 19 October 2026.
