CVE-2026-38751: Arbitrary File Upload in OpenSTAManager

CVE-2026-38751 is an arbitrary file upload vulnerability in the module update functionality of OpenSTAManager version 2.10 and earlier. The flaw is located in modules/aggiornamenti/upload_modules.php and allows unauthorized file uploads. System administrators and IT teams managing OpenSTAManager instances are directly exposed to compromise risk.

The CVSS score is 7.2, rated as high severity. The vulnerability was published on NVD on May 4, 2026. As of today (October 30, 2026), public repositories on GitHub report toolkits for file upload and related code execution. These signals indicate active interest in the flaw, though they do not confirm verified public exploitation. Status remains unconfirmed outside these signals.

For defense: verify which version of OpenSTAManager is running in your systems. Await official vendor patch and apply it as soon as available. In the meantime, implement strict access control to the update module, restricting it to authorized personnel. Monitor file upload logs and module access, looking for anomalous patterns or unexpected files.