CVE-2026-2184 is an OS command injection flaw in the Great Developers Certificate Generation System, scored 7.3 (High). The photo parameter in csv.php reaches an operating system command. The project uses rolling releases and its repository has been inactive for years, so retire the app or restrict access.
What's affected
- Product: Great Developers Certificate Generation System
- Affected: all code up to commit 97171bb0e5e22e52eacf4e4fa81773e5f3cffb73. There are no version numbers
- Location:
/restructured/csv.php, through the photo parameter - Fixed version: none. The record says the repository has not been active for many years
- Public detail: a researcher report is public. The CVE is not in the CISA Known Exploited Vulnerabilities catalog.
How to check if you're exposed
Look for the file:
find /var/www /srv /opt /home -path "*/restructured/csv.php" 2>/dev/null
If it is present, check who can reach it. A command injection runs with the rights of the web server user, so find out what that user can read and write. Review web server logs for odd requests to this page and for new files or processes that appeared around them.
What to do now
- Find and remove public copies of the app, or restrict them to a VPN.
- Run the web server user with the fewest rights possible, and keep secrets out of its reach.
- Check logs and the file system for unexpected files or processes near the page.
- If you keep the code, stop passing request values to shell commands. Use language functions for the task instead.
- Replace the app with a maintained one.
Why it matters
The record lists CWE-78, OS command injection, and CWE-77, command injection. The page builds a command string that includes a value taken from the request. If the value is not controlled, the shell can read parts of it as commands.
We do not repeat the details from the researcher report. The general cure is to avoid shell commands for tasks that the language can do directly, such as creating a folder, and to validate every value that is left.
As with its sibling issue in the same file, no vendor fix is likely. Retire or rewrite the handler.
Quick check
What can the attacker run?
Anything the web server user can run. That is why limiting that user matters.
Is there a patch?
No. The project has no version numbers and has been inactive for years.
Sources
Last reviewed: 19 October 2026.
