Area Species Management Research Program - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/area-species-management-research-program/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 12 Nov 2026 14:03:00 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgU.S. Geological Survey Area Species Management Research Program unrestricted file upload (CVE-2026-107356)https://feed.craftedsignal.io/briefs/2026-11-usgs-armi-upload-cve-2026-107356/Thu, 12 Nov 2026 14:03:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-usgs-armi-upload-cve-2026-107356/The U.S. Geological Survey Area Species Management Research Program contains an unrestricted file upload vulnerability that allows authenticated attackers to upload and execute crafted PHP files.The U.S. Geological Survey Area Species Management Research Program (ARMI) is vulnerable to an unrestricted file upload issue. The application stores uploaded files in the '/uploads/' directory. An authenticated, remote attacker can upload a crafted PHP file that executes and returns command output from the server when accessed.

Impact

Successful exploitation allows an authenticated attacker to execute and retrieve command output from the server.

Recommendation

Apply the vendor-provided patch released on 2026-07-20.

]]>highadvisory