CVE-2026-116602: SourceCodester Online Food Ordering System delete.php unlink path traversal
A vulnerability was detected in SourceCodester Online Food Ordering System 1.0. This issue affects the function unlink of the file admin/delete.php. Performing a manipulation of the argument imagename results in path traversal. The attack is possible to be carried out remotely. The exploit is now public and may be used.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The issue can be exploited remotely and does not require privileges or user interaction. An attacker can manipulate the image_name argument handled by admin/delete.php.
What is the likely impact of successful exploitation?
The vulnerable unlink operation can be influenced through path traversal, which can allow deletion of files outside the intended path. The provided severity vector indicates impacts to integrity and availability, with no confidentiality impact.
How urgent is remediation?
A public exploit is available, and the attack complexity is low. Prioritize remediation for internet-accessible instances, especially where the administrative delete.php endpoint can be reached remotely.