---
id: "CVE-2026-123988"
page: "https://infrastack.ai/live/CVE-2026-123988"
kind: "vulnerability"
aliases: ["CVE-2026-123988"]
title: "Food Ordering System: admin directory listing exposes files to remote visitors"
severity: "medium"
cvss: 5.5
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["food-ordering-system", "other", "php", "self-hosted"]
not_affected_if: ["admin-folder-blocked", "not-deployed"]
published_at: "2026-11-07T14:17:02+00:00"
first_seen_at: "2026-11-07T14:47:39+00:00"
updated_at: "2026-11-07T14:49:45+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123988", "first_seen_at": "2026-11-07T14:47:39+00:00"}]
exploit_sources: []
---

# Food Ordering System: admin directory listing exposes files to remote visitors

Link for people: https://infrastack.ai/live/CVE-2026-123988 (this .md is for agents)

The SililaWijesinghe Food Ordering System serves a directory listing of its /admin/ folder. A remote attacker can browse those files without logging in, which may reveal internal files.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Request the `/Food-Ordering-System/admin/` path on your deployment without logging in and see whether a file listing appears
- Check the web server config for `Options Indexes` (Apache) or `autoindex on` (nginx) covering that folder

## Timeline

- 2026-11-07T14:47:39+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123988

## From the sources

A vulnerability has been found in SililaWijesinghe Food Ordering System up to ba314e897e3365600461e5ea59432e39ceaa0fa5. This issue affects some unknown processing of the file /Food-Ordering-System/admin/. Such manipulation leads to exposure of information through directory listing. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_