---
id: "CVE-2026-127283"
page: "https://infrastack.ai/live/CVE-2026-127283"
kind: "vulnerability"
aliases: ["CVE-2026-127283"]
title: "SourceCodester Food Ordering System: admin image handler allows unrestricted remote file upload"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "SourceCodester Food Ordering System", "fixed": [], "affected": "1.0", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["file-upload", "food-ordering-system", "other", "php", "self-hosted", "sourcecodester"]
not_affected_if: ["admin-not-exposed", "auth-required"]
published_at: "2026-11-13T02:18:55+00:00"
first_seen_at: "2026-11-13T02:41:36+00:00"
updated_at: "2026-11-13T02:45:07+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-127283", "first_seen_at": "2026-11-13T02:41:36+00:00"}, {"source": "analyst", "url": "https://vuldb.com/submit/1022954", "first_seen_at": "2026-11-13T02:45:07+00:00", "cites": ["https://vuldb.com/submit/1022954", "https://vulners.com/packetstorm/PACKETSTORM:228489"]}]
exploit_sources: [{"type": "poc", "url": "https://vulners.com/packetstorm/PACKETSTORM:228489"}]
---

# SourceCodester Food Ordering System: admin image handler allows unrestricted remote file upload

Link for people: https://infrastack.ai/live/CVE-2026-127283 (this .md is for agents)

Admin food update handler admin/update_food.php in SourceCodester Online Food Ordering System 1.0 accepts uploaded files without restricting type. A public Packet Storm write-up describes uploading a PHP file for remote code execution, and says the attacker must be an authenticated admin. No vendor patch is known.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:SourceCodester Food Ordering System affected 1.0 fixed no fixed version listed

## How to check

- Look for admin/update_food.php in the web root of the PHP app (SourceCodester Online Food Ordering System 1.0).
- Check the upload directory used for food images for .php or other script files you did not put there.
- Version: the code is distributed as 1.0 with no version string in the sources; if you installed this download, assume 1.0.
- Also check admin/add_food.php and admin/update_category.php: a VulDB submission reports similar missing upload checks there (separate CVE-2026-116603 covers add_food.php).

## Fix

No vendor fix or patched version found in the sources. Mitigate: restrict /admin/ to trusted IPs or put it behind extra authentication, allow only image extensions and MIME types, store uploads outside the web root, and disable PHP execution in the upload directory.

## Timeline

- 2026-11-13T02:41:36+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-127283
- 2026-11-13T02:45:07+00:00 analyst https://vuldb.com/submit/1022954 — NVD page had no content; Packet Storm PoC (admin must be authenticated, /web/admin/update_food.php) and VulDB submission read. No vendor fix found; this is a hobby sample app. Not verified, no primary vendor page. CVSS vector says PR:N while the PoC says auth is needed: conflict noted.

## Documents

- [describes] VulDB Submit #1022954: Online Food Ordering System unrestricted upload https://vuldb.com/submit/1022954
- [poc] Online Food Ordering System 1.0 Shell Upload (Packet Storm, nu11secur1ty) https://vulners.com/packetstorm/PACKETSTORM:228489

## From the sources

A vulnerability was identified in SourceCodester Food Ordering System 1.0. Affected by this issue is some unknown functionality of the file admin/update_food.php of the component Admin Image Handler. Such manipulation of the argument cmd leads to unrestricted upload. The attack may be performed from remote. The exploit is publicly available and might be used.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_