CVE-2026-2183 is an unrestricted file upload flaw in the Great Developers Certificate Generation System, scored 6.3 (Medium). The csv.php upload handler accepts files without enough checks. It is a rolling release project with no version numbers, and the repository has been inactive for years, so retire it or block uploads.
What's affected
- Product: Great Developers Certificate Generation System
- Affected: all code up to commit 97171bb0e5e22e52eacf4e4fa81773e5f3cffb73. The project uses rolling releases and gives no version numbers
- Location:
/restructured/csv.php - Fixed version: none. The record says the repository has not been active for many years
- Public detail: a researcher report is public. The CVE is not in the CISA Known Exploited Vulnerabilities catalog.
How to check if you're exposed
Check whether the code is deployed, and how it came to you:
find /var/www /srv /opt /home -path "*/restructured/csv.php" 2>/dev/null
If it exists, look at the upload folder for files that are not CSV data, and check whether the web server will run scripts from that folder. Both are signs that a hostile upload may already have landed. Confirm who can reach the page.
What to do now
- Locate every copy of the app and take public ones offline.
- Check upload folders for files that are not what the app expects, and remove any you find after saving a copy for analysis.
- Configure the web server so it never runs scripts from upload folders.
- If you must keep the app, limit accepted file types and sizes in code and store uploads outside the web root.
- Plan to replace the app, since no fix is likely from an inactive project.
Why it matters
The record lists CWE-434, unrestricted upload of a file with a dangerous type, and CWE-284, improper access control. The upload handler for CSV files does not verify what it receives, so a user can store files of other kinds on the server. The danger depends on where they land and whether the server runs them.
Upload handlers are a classic weak point. Safe ones check the type by content, rename files, store them where they cannot run, and require a signed in user.
This is also a project with no maintainer. When a repository has been inactive for years, a fix will not arrive, and retiring the app is often cheaper than patching it.
Quick check
Is there a fixed version?
No. The project uses rolling releases and the record says the repository has been inactive for years.
Is this the same flaw as CVE-2026-2184?
No. Both involve the same file, but CVE-2026-2184 concerns command injection through the photo parameter. Fix both by retiring or rewriting the handler.
Sources
Last reviewed: 19 October 2026.
