CVE-2026-2133 is a high severity unrestricted file upload flaw (CVSS 7.3) in code-projects Online Music Site 1.0. The txtimage parameter of AdminUpdateCategory.php accepts files it should reject. The record lists no fixed version, so isolate the app and block executable uploads.
What's affected
The record names code-projects Online Music Site 1.0. The weakness is classed as CWE-434 (unrestricted upload of a file with a dangerous type) and CWE-284 (improper access control). The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L.
No fixed version is listed and I could not find a vendor advisory. The record says an exploit was publicly released. It does not say the flaw is exploited in the wild, and it is not in the CISA Known Exploited Vulnerabilities catalog.
How to check if you're exposed
Find the app and the folder where it saves uploaded images.
find /var/www -type f -name "AdminUpdateCategory.php" 2>/dev/null
Then look in the upload folder for files that are not images. Anything ending in a script extension such as .php, .phtml or .phar does not belong there.
find /var/www -type f \( -name "*.php" -o -name "*.phtml" -o -name "*.phar" \) -path "*upload*" 2>/dev/null
Check web server logs for POST requests to the category script from unknown addresses, and compare file modification times in the upload folder with your last known good state.
What to do now
- Take the app off the public internet, or restrict it to a VPN or allowlist.
- Stop the web server from running scripts inside the upload folder. In Apache or Nginx, serve that folder as static files only.
- On the server side, check the file extension against an allowlist, check the content type by reading the file, and store files under a random name outside the web root where you can.
- If you find an unexpected script in the upload folder, treat the host as compromised: preserve logs, remove the file, rotate credentials and review other files changed since the upload.
- Check the vendor page and the NVD entry for a fixed release, and replace the app if none appears.
Why it matters
File upload bugs are serious because the file lands on your server. If the server will run it, the upload turns into code execution under the web server account, and that may reach the database, other sites on the host and stored secrets.
The usual cause is trusting what the browser says about a file. The name and the content type both come from the client and can be anything. A safe design checks them on the server, limits size, renames the file and never lets the upload folder execute code.
This app also has CVE-2026-2132, a SQL injection in the same script. Two flaws in one file are a reason to review the whole admin area.
Quick check
Does the record say remote code execution is possible?
No. It says unrestricted upload. Whether that becomes code execution depends on how the server treats the upload folder, which is why the folder setting matters.
Sources
- Researcher report on GitHub (linked from the record)
- NVD record for CVE-2026-2133
Last reviewed: 19 October 2026.
