CVE-2026-2184
Published: 08 February 2026
Summary
CVE-2026-2184 is a high-severity Command Injection (CWE-77) vulnerability in Greatdevelopers Certificate. Its CVSS base score is 7.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 19.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Threat & Defense at a Glance
Threat & Defense Details
Likely Mitigating ControlsAI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
OS command injection in public-facing web component (/restructured/csv.php) directly enables remote arbitrary command execution (T1190) via shell interpreters (T1059).
NVD Description
A vulnerability was detected in Great Developers Certificate Generation System up to 97171bb0e5e22e52eacf4e4fa81773e5f3cffb73. This vulnerability affects unknown code of the file /restructured/csv.php. The manipulation of the argument photo results in os command injection. The attack can be executed remotely. This…
more
product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The code repository of the project has not been active for many years.
Deeper analysisAI
CVE-2026-2184 is an OS command injection vulnerability in the Great Developers Certificate Generation System up to commit 97171bb0e5e22e52eacf4e4fa81773e5f3cffb73. The issue resides in unknown code within the file /restructured/csv.php, where manipulation of the 'photo' argument triggers the injection. The product uses a rolling release model, making specific version information for affected or patched releases unavailable, and its code repository has been inactive for many years.
The vulnerability carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) and maps to CWE-77 (Command Injection) and CWE-78 (OS Command Injection). A remote attacker requires no privileges or user interaction to exploit it over the network with low complexity, potentially achieving low-level impacts on confidentiality, integrity, and availability through arbitrary OS command execution.
Advisories referenced in VulDB entries (ctiid.344887, id.344887, submit.749714) and a GitHub discovery note (lakshayyverma/CVE-Discovery) document the flaw but provide no details on patches or mitigations, consistent with the project's inactive repository and lack of versioned releases. Security practitioners should isolate or decommission affected instances.
Details
- CWE(s)