CVE-2026-104637 is a High severity unrestricted upload flaw in HospitalManagementSystem, an open source PHP project by onetwothreeneth. Seven handlers in php/controller.php save an uploaded file to a web accessible folder without checks, which can lead to remote code execution. The project is rolling release with no fixed version.
What's affected
- Product: HospitalManagementSystem, a PHP application by onetwothreeneth, up to commit 9ef91ed6007314b6473110ed699dff76d158f61d.
- Affected component: php/controller.php, in the add and edit patient, physician and account handlers, through the img argument.
- Versions: none. The record says the project is rolling release and gives no version numbers.
- Fixed: not confirmed. The public issue was open on the page I read.
- Score: CVSS 7.3, High.
How to check if you're exposed
No package manager is involved, so look at the code and the folder.
git log -1 --format=%H
grep -n "move_uploaded_file" php/controller.php
ls -la img/
The first line gives your commit. The second finds the upload handling in the controller. The third lists the folder that receives the files. Any file in it with a script extension, such as php, is a warning sign and should be investigated.
Then confirm whether the application is reachable from outside. The public issue says the handlers need no authentication or role check. Check web server logs for POST requests to these handlers from addresses you do not recognise, and for later requests to unusual files in the img folder.
If this system holds patient data in any real setting, treat the check as urgent.
What to do now
- Do not run this project on the public internet. If it is running, take it offline or restrict access at the web server.
- Allow only the image types you need, checked by content as well as by extension, and save files under a generated name.
- Store uploads outside the web root, or turn off script execution in the upload folder.
- Require authentication and a role check before any add or edit handler runs.
- Search the upload folder and the web root for unfamiliar script files and review the database for changed records.
- If real patient data is involved, involve your privacy and security officers, and consider moving to a maintained, audited product.
Why it matters
The record lists CWE-434, unrestricted upload of a dangerous file type, and CWE-284, improper access control. The public issue describes it plainly: the handlers write the uploaded file straight into the img folder with only a basename call, and nothing checks who is asking or what the file is.
That combination is the worst form of the bug. With no login required, anyone who can reach the form can place a file on the server, and if the server runs it as a script, the attacker gets code execution. The record also says a public exploit disclosure exists. It does not say the issue is exploited in the wild, and it is not in the CISA catalog.
Healthcare themed sample projects tend to be copied into real deployments. Systems that handle patient information deserve security review and maintained software. Static analysis would flag this pattern in seconds.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is a fix available?
None is confirmed. The project is rolling release and the record lists no fixed version, so rework the upload handling yourself or stop using it.
Does the attacker need to log in?
The public issue says there is no authentication or role check on these handlers.
Sources
Last reviewed: 18 October 2026.
