U.S. Geological Survey Area Species Management Research Program unrestricted file upload (CVE-2026-107356)
The U.S. Geological Survey Area Species Management Research Program contains an unrestricted file upload vulnerability that allows authenticated attackers to upload and execute crafted PHP files.
CVE search metadata
CVE search record: CVE-2026-107356. Severity: high. CVSS: 8.8. EPSS: 0.74%. KEV: no. Product: Area Species Management Research Program. Brief: U.S. Geological Survey Area Species Management Research Program unrestricted file upload (CVE-2026-107356). Brief link: https://feed.craftedsignal.io/briefs/2026-11-usgs-armi-upload-cve-2026-107356/
Triage facts
Revision 1- Applicability
- Area Species Management Research Program
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 12, 14:03 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
The U.S. Geological Survey Area Species Management Research Program (ARMI) is vulnerable to an unrestricted file upload issue. The application stores uploaded files in the '/uploads/' directory. An authenticated, remote attacker can upload a crafted PHP file that executes and returns command output from the server when accessed.
Impact
Successful exploitation allows an authenticated attacker to execute and retrieve command output from the server.
Recommendation
Apply the vendor-provided patch released on 2026-07-20.