CVE-2026-2183: 
NixOS vulnerability analysis and mitigation

CVE-2026-2183 is an unrestricted file upload vulnerability (CWE-434) in the Great Developers Certificate Generation System, affecting the /restructured/csv.php endpoint. All versions up to commit 97171bb0e5e22e52eacf4e4fa81773e5f3cffb73 (dated 2017-10-16 and earlier) are affected. The vulnerability was published on February 8, 2026, and assigned by VulDB. It carries a CVSS v3.1 base score of 9.8 (Critical) and a CVSS v4.0 base score of 5.3 (Medium) (VulDB, Red Hat CVE). The project repository has been inactive for many years and no patch is available.

The root cause is improper file validation (CWE-434 / CWE-284) in the CSV upload handler (csv.php). The application uses strrchr() to check only the last file extension and directly concatenates the user-supplied filename into the upload destination path — meaning a crafted filename such as payload.csv.php passes the .csv extension check while being stored as an executable PHP file. No MIME type verification, content inspection, or file size restriction is performed. Uploaded files are stored in the web-accessible directory uploads/csv/data/, enabling direct HTTP access and potential server-side execution (GitHub PoC).

Successful exploitation allows an authenticated attacker to upload arbitrary files — including PHP web shells — to a web-accessible directory, potentially achieving remote code execution on the server. This results in full compromise of confidentiality, integrity, and availability: attackers can exfiltrate data, modify or delete system files, deploy persistent backdoors, host malware, or cause denial of service via large file uploads. The scope is limited to the affected system, but a foothold could enable lateral movement within the hosting environment (GitHub PoC, VulDB).

A proof-of-concept exploit is publicly available on GitHub, documented by researcher lakshayyverma (GitHub PoC). The exploit was added to tracking databases on February 24, 2026. There is no confirmed evidence of in-the-wild exploitation at this time, and no threat actor attribution has been made. The EPSS score is approximately 0.02%, reflecting low but non-zero probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Note that CVSS v2 requires authentication (single), while the CVSS v3.1 score of 9.8 assumes no authentication is required — the actual authentication requirement may vary by deployment (VulDB).

1. Reconnaissance: Identify internet-facing instances of the Great Developers Certificate Generation System by searching for the path /restructured/csv.php using tools like Shodan, Censys, or Google dorks.
2. Authenticate (if required): Depending on deployment configuration, obtain valid credentials to access the CSV upload functionality.
3. Craft malicious file: Create a PHP web shell file with a double extension to bypass the strrchr()-based validation, e.g., shell.csv.php, containing a payload such as <?php system($_GET['cmd']); ?>.
4. Upload the file: Submit the crafted file via an HTTP POST request to /restructured/csv.php using the file parameter. The application checks only that the last extension is .csv via strrchr(), which returns .php for shell.csv.php — however, the concatenation of uniqid() with the original filename means the stored file retains the .php extension suffix.
5. Locate the uploaded file: The file is stored under uploads/csv/data/<uniqid>shell.csv.php, which is web-accessible.
6. Execute arbitrary commands: Access the uploaded web shell via HTTP (e.g., http://target/uploads/csv/data/<uniqid>shell.csv.php?cmd=id) to achieve remote code execution on the server (GitHub PoC).

• Network: HTTP POST requests to /restructured/csv.php with multipart file uploads containing filenames with double extensions (e.g., *.csv.php, *.csv.phtml); subsequent HTTP GET requests to paths under /uploads/csv/data/ with query parameters suggestive of command execution (e.g., ?cmd=, ?exec=).
• File System: Unexpected PHP or script files in the uploads/csv/data/ directory with double extensions or unusual names prefixed with a uniqid()-style timestamp string; web shell files containing functions like system(), exec(), passthru(), or shell_exec().
• Logs: Web server access logs showing POST requests to /restructured/csv.php followed by GET requests to files in /uploads/csv/data/; error logs showing PHP execution from the uploads directory; unusual outbound connections originating from the web server process.
• Process: Unexpected child processes spawned by the web server (e.g., sh, bash, curl, wget) with command-line arguments indicating remote access or data exfiltration (GitHub PoC).

No official patch is available, as the project repository has been inactive since at least 2017. Recommended mitigations include: (1) Disable or restrict access to the /restructured/csv.php endpoint if not actively required; (2) Restrict network access to the application, limiting exposure to trusted internal networks only; (3) Disable PHP execution in the uploads/csv/data/ directory via web server configuration (e.g., Apache .htaccess or Nginx location block); (4) Implement WAF rules to detect and block uploads with double extensions or non-CSV MIME types; (5) Monitor file upload activity for suspicious file types; (6) Consider migrating to an actively maintained alternative or fork the code to apply custom security patches (Red Hat CVE, GitHub PoC).