CVE-2026-6602
Published: 20 April 2026
Summary
CVE-2026-6602 is a medium-severity Improper Access Control (CWE-284) vulnerability. Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 4.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2026-6602 is an unrestricted file upload vulnerability in the rickxy Hospital Management System, affecting versions up to commit 88a4290d957dc5bdde8a56e5ad451ad14f7f90f4. The issue resides in an unknown function within the file /backend/admin/his_admin_account.php, where manipulation of the ad_dpic argument enables the upload. It is associated with CWEs 284 (Improper Access Control) and 434 (Unrestricted Upload of File with Dangerous Type), and carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).
The vulnerability is exploitable remotely by unauthenticated attackers requiring low attack complexity and no user interaction. Successful exploitation results in limited impacts to confidentiality, integrity, and availability, such as potential execution of malicious files if dangerous types are uploaded.
Advisories and details are documented on VulDB (https://vuldb.com/vuln/358237, https://vuldb.com/vuln/358237/cti, https://vuldb.com/submit/792092) and a GitHub issue (https://github.com/freeloader9527/cve/issues/2). The product uses a rolling release model, so version information for affected or updated releases is unavailable, complicating patch identification.
The exploit has been made public and could be used in attacks.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-23768
Vulnerability details
A vulnerability was found in rickxy Hospital Management System up to 88a4290d957dc5bdde8a56e5ad451ad14f7f90f4. Affected is an unknown function of the file /backend/admin/his_admin_account.php. The manipulation of the argument ad_dpic results in unrestricted upload. The attack can be executed remotely. The exploit has…
more
been made public and could be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unrestricted file upload in public-facing web app directly enables T1190 exploitation and T1505.003 web shell deployment for malicious file execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the unrestricted file upload flaw in /backend/admin/his_admin_account.php by identifying, patching, and verifying fixes for this specific CVE.
Validates the ad_dpic parameter to ensure only safe file types, sizes, and contents are accepted, preventing exploitation of the unrestricted upload vulnerability.
Enforces authentication and authorization mechanisms to block unauthenticated remote access to the vulnerable /backend/admin/his_admin_account.php endpoint.