{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"2.10-beta"}],"component":"devcode-it/openstamanager","cve_ids":["CVE-2026-38751"],"ecosystem":"Packagist","epss":0.00464,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-rm34-fg4m-39mw","id":"tcs_01M5KF8CDJ1AHVQJBWSMCHKVTA","modified_at":"2026-05-08T19:11:29.761369Z","published_at":"2026-05-04T21:30:24Z","references":["https://osv.dev/vulnerability/GHSA-rm34-fg4m-39mw","https://nvd.nist.gov/vuln/detail/CVE-2026-38751","https://github.com/devcode-it/openstamanager","https://github.com/fuutianyii/poc"],"severity":{"label":"high","score":7.2},"sources":[{"source":"osv","source_id":"GHSA-rm34-fg4m-39mw","url":"https://osv.dev/vulnerability/GHSA-rm34-fg4m-39mw"}],"summary":"OpenSTAManager contains an arbitrary file upload vulnerability in its module update functionality"}