sourcecodester Personnel Property Equipment System v1.0 is vulnerable to arbitrary code execution in ip/ppes/admin/admin_change_picture.php.

CVE-2026-26699 affects sourcecodester Personnel Property Equipment System v1.0, allowing arbitrary code execution through the admin_change_picture.php file in the admin interface. This remote code execution vulnerability poses a high risk as it could allow attackers to execute malicious code on the affected system. The vulnerability is located in the file path ip/ppes/admin/admin_change_picture.php. The issue has been documented with a proof of concept available on GitHub. This represents a critical security flaw that could lead to complete system compromise.