Hospital Management System Hit by Remote Unrestricted File Upload

The National Vulnerability Database (NVD) has disclosed CVE-2026-6602, a high-severity vulnerability affecting rickxy Hospital Management System versions up to 88a4290d957dc5bdde8a56e5ad451ad14f7f90f4. This flaw, rated 7.3 CVSS, allows for unrestricted file upload due to improper handling of the ad_dpic argument in /backend/admin/his_admin_account.php. Attackers can exploit this remotely, and public exploits are already available.

This isn’t just a theoretical bug; it’s a critical remote code execution vector. An attacker can upload a malicious web shell, gaining persistent access and control over the system. For hospital systems, this means direct access to patient data, operational disruption, or even the deployment of ransomware. The NVD notes that rickxy employs a rolling release model, making specific versioning for affected or updated releases unavailable, which complicates patching efforts.

Defenders must prioritize identifying instances of rickxy Hospital Management System within their environments. Given the public exploit and remote attack vector, this vulnerability presents an immediate and severe risk. Without clear versioning, assume all installations are vulnerable unless proven otherwise. Focus on network segmentation to isolate these systems and implement robust egress filtering to prevent outbound connections from compromised servers.