CVE-2026-26699 affects sourcecodester Personnel Property Equipment System v1.0, allowing arbitrary code execution through the admin_change_picture.php file in the admin interface. The vulnerability is located in the ip/ppes/admin/admin_change_picture.php endpoint and enables remote code execution attacks. This represents a critical security flaw in the web application that could allow attackers to execute malicious code on the server. The vulnerability has been documented with a proof-of-concept available on GitHub.