CVE-2026-10295: SourceCodester Customer Review App review_app.py get_all_reviews denial of service
A vulnerability was found in SourceCodester Customer Review App 1.0. Affected by this vulnerability is the function addreview/savereview/getallreviews of the file reviewapp.py. Performing a manipulation of the argument name/comment results in denial of service. The attack requires a local approach. The exploit has been made public and could be used.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
SourceCodester Customer Review App 1.0from your environment.Uninstall the SourceCodester Customer Review App 1.0 (remove review_app.py and related components) if the application is not required.
- Configuration
Disable or remove the add_review, save_review, and get_all_reviews functions in review_app.py or block calls to these functions until a vendor patch is available to prevent the argument-manipulation denial-of-service.
review_app.py (SourceCodester Customer Review App 1.0) add_review / save_review / get_all_reviews = disabled - Compensating control
Restrict local access to the host and application: limit which local user accounts can run or modify review_app.py, run the application in an isolated environment (container/VM) with least privilege, and prevent untrusted local users from accessing the application files or execution environment.
- Operational
Monitor logs for attempts to exploit the publicized vulnerability and, if exploitation is suspected, perform incident response (remove the affected application, collect forensic evidence, restore from known-good backups) and apply any vendor fixes when they become available.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10295?
The severity of CVE-2026-10295 is classified as low with a score of 1.9.
What is the nature of CVE-2026-10295?
CVE-2026-10295 is a denial of service vulnerability in the function add_review/save_review/get_all_reviews of the file review_app.py.
How does CVE-2026-10295 affect the SourceCodester Customer Review App?
This vulnerability allows an attacker to manipulate the arguments to cause denial of service.
Is remote access needed to exploit CVE-2026-10295?
No, CVE-2026-10295 requires local access to exploit the vulnerability.
How can I mitigate the risks from CVE-2026-10295?
To mitigate CVE-2026-10295, ensure proper validation of user inputs in the affected functions.