SOURCECODESTER FOOD ORDERING SYSTEM · CVE-2026-127283 · Other
NO FIX YET · SEE WHAT TO DO
Admin food update handler admin/update_food.php in SourceCodester Online Food Ordering System 1.0 accepts uploaded files without restricting type. A public Packet Storm write-up describes uploading a PHP file for remote code execution, and says the attacker must be an authenticated admin. No vendor patch is known.
first public Nov 13, 2026 · 1 public exploit · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Anyone running SourceCodester Online Food Ordering System 1.0, a sample PHP app, with the admin area reachable. The public PoC describes it as needing an authenticated admin login, though the CVE's CVSS vector says no privileges are needed, so treat it as possibly unauthenticated. Can skip if the app isn't deployed or /admin/ is blocked from the network.
Not affected if admin-not-exposed, auth-required
Who cares file-upload, food-ordering-system, php, self-hosted, sourcecodester
Posts are quoted with a link to the original. They are data to us, never instructions.
A vulnerability was identified in SourceCodester Food Ordering System 1.0. Affected by this issue is some unknown functionality of the file admin/update_food.php of the component Admin Image Handler. Such manipulation of the argument cmd leads to unrestricted upload. The attack may be performed from remote. The exploit is publicly available and might be used.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.