CVE-2026-10559: SourceCodester Pizzafy Ecommerce System index.php file inclusion
A flaw has been found in SourceCodester Pizzafy Ecommerce System 1.0. The affected element is an unknown function of the file /index.php. Executing a manipulation of the argument page can lead to file inclusion. The attack may be performed from remote. The exploit has been published and may be used.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
SourceCodester Pizzafy Ecommerce Systemfrom your environment.If the application is not required, uninstall or take the instance offline until a code-level fix is implemented to eliminate the file-inclusion vulnerability.
- Configuration
Remove any dynamic include/require that uses the 'page' argument. Implement strict input validation: map allowed 'page' values to fixed internal files (allowlist), reject or default unknown values, and disallow directory traversal or remote file paths. Ensure the application never includes files based on unchecked user-supplied input.
SourceCodester Pizzafy Ecommerce System (/index.php) page parameter handling = validate and restrict to an allowlist; do not perform direct file inclusion from user input - Compensating control
Until code is fixed, block or restrict remote access to the vulnerable endpoint: apply WAF rules or firewall ACLs to block requests attempting file inclusion (e.g., requests with a 'page' parameter containing '../', 'http', or suspicious file extensions), and/or restrict access to the application or management interfaces to trusted IP addresses only.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10559?
CVE-2026-10559 has a low severity rating of 2.1.
How do I fix CVE-2026-10559?
To fix CVE-2026-10559, ensure that the page parameter is properly validated and sanitized before processing it in index.php.
What impact does CVE-2026-10559 have on my system?
CVE-2026-10559 may allow remote attackers to perform file inclusion attacks through manipulation of the page argument.
Which software is affected by CVE-2026-10559?
CVE-2026-10559 affects the SourceCodester Pizzafy Ecommerce System version 1.0.
Can CVE-2026-10559 be exploited remotely?
Yes, CVE-2026-10559 can be exploited remotely by manipulating the page parameter.