Live › vulnerability › CVE-2026-116602
Go to dashboardThe admin/delete.php script passes the image_name argument to unlink() without sanitising it, so a crafted value can point outside the intended directory. A remote attacker can use this to delete arbitrary files the web server process can write to, and a public exploit exists.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 23:25 UTC. All times on this page are UTC.
Sites running SourceCodester Online Food Ordering System 1.0 with the admin panel reachable. Installations that do not deploy this script or keep the admin area behind a network restriction are less exposed. The sources do not name a patched release.
No product ranges from the sources yet.
Unknown from the sources.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was detected in SourceCodester Online Food Ordering System 1.0. This issue affects the function unlink of the file admin/delete.php. Performing a manipulation of the argument image_name results in path traversal. The attack is possible to be carried out remotely. The exploit is now public and may be used.
This page as .md · .json · in your agent: get_signal("CVE-2026-116602")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.