Area Species Management Research Program: Unrestricted file upload
Summary
The USGS Area Species Management Research Program (ARMI) accepts any uploaded file and stores it under '/uploads/'. An authenticated remote attacker with low privileges can upload a crafted PHP file and run it on the server to execute commands and read their output. No user interaction is required; the CVSS 4.0 base score is 8.7 (High).
Affected
- U.S. Geological Survey Area Species Management Research Program (ARMI), all versions before 2026-07-20
- Exact version numbers: unknown.
Fixed in
- Fixed on 2026-07-20 (unaffected from this date).
- Fixed version number: unknown.
Workaround
- No vendor workaround known.
- Generic CWE-434 guidance: generate a new, unique filename for each upload instead of using the user-supplied name.
- Restrict permitted file types server-side and ensure uploaded files cannot be executed by the web server.
Exploitation
- Not known to be exploited.
- No public proof of concept or CISA KEV listing found at the time of research.
Our recommendation
- If you run this application, apply the vendor fix dated 2026-07-20 or later and confirm the version with the vendor.
- Review the CISA CSAF advisory va-26-313-01 for remediation details.
- Check that uploads are not executable and are stored outside the web root or without execution rights.
- Monitor web server logs for unexpected PHP files under /uploads/.
- If you do not run this software, no action is needed beyond checking your inventory.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE record (CISA as CNA) www.cve.org
- CISA CSAF advisory va-26-313-01 raw.githubusercontent.com
- OffSeq threat radar (exploitation status, CWE guidance) radar.offseq.com
- Strix (NVD status) www.strix.ai
- ThreatInt (description, CVSS) cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 00:57.
Original description (NVD)
U.S. Geological Survey Area Species Management Research Program (ARMI) accepts any uploaded file and stores the file under '/uploads/{upload-file}'. A remote, authenticated attacker could upload a crafted PHP file that executes and returns command output from the server when accessed. Fixed on 2026-07-20.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.