CVE-2026-116603: SourceCodester Online Food Ordering System add_food.php unrestricted upload
Published Oct 26, 2026
·Updated
A flaw has been found in SourceCodester Online Food Ordering System 1.0. Impacted is an unknown function of the file admin/addfood.php. Executing a manipulation of the argument image can lead to unrestricted upload. The attack may be performed from remote. The exploit has been published and may be used.
Affected Software
1 affected component
Sourcecodester Online Food Ordering System=1.0
Event History
Oct 26, 2026
CVE Published
via MITRE·11:30 PM
Data Sourced
via MITRE·11:30 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
An attacker needs high privileges, as reflected by the PR:H vector, but can perform the attack remotely without user interaction. The vulnerable upload handling is associated with the image argument in admin/add_food.php.
2
Is public exploit code available?
Yes. The available data states that an exploit has been published and may be used.
3
What is the potential impact of successful exploitation?
The issue can allow unrestricted file upload. The supplied severity vector rates confidentiality, integrity, and availability impact as low.