CVE-2026-6489

CVE-2026-6489 is an unrestricted file upload vulnerability affecting QueryMine SMS up to commit 7ab5a9ea196209611134525ffc18de25c57d9593. The flaw exists in the admin/addteacher.php component of the Background Management Page, where the image parameter can be manipulated to upload arbitrary files without proper validation. This product does not use version numbering, making it difficult to determine affected releases. The vulnerability carries a CVSS 3.1 score of 6.3 (Medium severity) with a network-based attack vector requiring low complexity and user authentication. While the impact on confidentiality, integrity, and authenticity is limited, successful exploitation could allow authenticated users to upload malicious files to the system. The FAUCET Risk Score of 35.0/100 indicates moderate concern within the threat landscape. Public exploit code has been released for this vulnerability, increasing the likelihood of active exploitation. The vendor was notified early but failed to respond or provide remediation guidance. While not yet listed on the known exploited vulnerabilities catalog, the combination of public exploit availability, vendor non-responsiveness, and active status on threat databases suggests this vulnerability warrants immediate attention for organizations running QueryMine SMS.