OpenSTAManager contains an arbitrary file upload vulnerability in its module update functionality

ALTO 7.2CVE-2026-38751 · GHSA-rm34-fg4m-39mw · Published 04/05/2026 · updated 17/06/2026

Package	Affected versions	Patched versions
devcode-it/openstamanager Packagist	`≤ 2.10-beta`	No fix yet
openstamanager devcode	`≤ 2.10`	No fix yet

Description

OpenSTAManager versions 2.10 and earlier contain an arbitrary file upload vulnerability in the module update functionality (modules/aggiornamenti/upload_modules.php).

NVD description

OpenSTAManager version 2.10 and earlier contains an arbitrary file upload vulnerability in the module update functionality (modules/aggiornamenti/upload_modules.php)

References

nvd.nist.gov/vuln/detail/CVE-2026-38751 · ADVISORY
devcode-it/openstamanager · PACKAGE
fuutianyii/poc · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free