Cyber Resilience

CVE-2026-26699

HighPublic PoCRCE

Published: 02 March 2026

Published
02 March 2026
Modified
04 March 2026
KEV Added
—
Patch
—
CVSS Score v3.1 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0005 15.4th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-26699 is a high-severity Code Injection (CWE-94) vulnerability in Jon-Remus-Sevellejo Personnel Property Equipment System. Its CVSS base score is 7.2 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 15.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and AC-6 (Least Privilege).

Deeper analysis

CVE-2026-26699 is an arbitrary code execution vulnerability (CWE-94) in the sourcecodester Personnel Property Equipment System version 1.0, specifically within the component ip/ppes/admin/admin_change_picture.php. Published on 2026-03-02T16:16:25.250, it carries a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact.

The vulnerability can be exploited over the network by an attacker with high privileges, such as an authenticated administrator (PR:H), requiring low complexity and no user interaction. Successful exploitation enables arbitrary code execution, granting high impacts on confidentiality, integrity, and availability within the application's scope.

Details on the vulnerability, including potential mitigation steps, are documented in the GitHub bug report at https://github.com/Thirtypenny77/bug_report/blob/main/sourcecodester/personel-property-equipment-system/RCE-1.md.

EU & UK References

Vulnerability details

sourcecodester Personnel Property Equipment System v1.0 is vulnerable to arbitrary code execution in ip/ppes/admin/admin_change_picture.php.

CWE(s)
CWE-94

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1505.003 Web Shell Persistence
Adversaries may backdoor web servers with web shells to establish persistent access to systems.
attack.mitre.org →
Why these techniques?

RCE vulnerability (CWE-94) in public-facing PHP web app component allows network exploitation for arbitrary code execution, directly mapping to initial access via public app exploitation and web shell deployment for persistent server-side execution.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2026-26702Same product: Jon-Remus-Sevellejo Personnel Property Equipment System
CVE-2026-26700Same product: Jon-Remus-Sevellejo Personnel Property Equipment System
CVE-2026-26701Same product: Jon-Remus-Sevellejo Personnel Property Equipment System
CVE-2026-26703Same product: Jon-Remus-Sevellejo Personnel Property Equipment System
CVE-2024-57487Shared CWE-94
CVE-2025-70995Shared CWE-94
CVE-2026-32367Shared CWE-94
CVE-2026-3352Shared CWE-94
CVE-2026-30117Shared CWE-94
CVE-2026-45708Shared CWE-94

Affected Assets

jon-remus-sevellejo
personnel property equipment system
1.0

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Enforces validation of all inputs (including uploaded files) to admin_change_picture.php, directly blocking the unsanitized data that enables arbitrary code execution.

AC-6 Least Privilege partial match
prevent

Restricts the high-privilege administrator account to only the minimum functions required, reducing the attack surface of the vulnerable picture-change endpoint.

SI-7 Software, Firmware, and Information Integrity partial match
detect

Detects unauthorized modification or execution of code resulting from exploitation of the file-upload flaw in admin_change_picture.php.

References