Volmarg Personal Management System file upload allows remote code execution

Logged-in users of this personal management program can hack the server.

Summary

In Volmarg Personal Management System through 2.1.0, an authenticated user can upload PHP files to /upload/send/ and run code on the web server. Anyone who installs and runs this program is affected.

Affected when

a logged-in user account

What to do

Check that you run a version newer than 2.1.0 and read the vendor's advisory. The sources do not name a fixed version.

Products and platforms

personal-management-system

CVE IDs

CVE-2026-73328 (opens in a new tab)

Sources

Write-up: github.com (opens in a new tab) · github.com (opens in a new tab) · github.com (opens in a new tab) · github.com (opens in a new tab) · vulncheck.com (opens in a new tab)

Times

First published 2026-11-03 15:17 UTC

First seen 2026-11-09 14:50 UTC