CVE-2026-127283
Deferred Deferred - Pending Action

Unrestricted File Upload in Food Ordering System 1.0

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: VulDB

Description
A vulnerability was identified in SourceCodester Food Ordering System 1.0. Affected by this issue is some unknown functionality of the file admin/update_food.php of the component Admin Image Handler. Such manipulation of the argument cmd leads to unrestricted upload. The attack may be performed from remote. The exploit is publicly available and might be used.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-127283
EUVD
EUVD-2026-124818

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
SourceCodester Food Ordering System 1.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the Food Ordering System 1.0, specifically in the admin/update_food.php file. It allows unrestricted file uploads due to improper handling of the 'cmd' argument. Attackers can exploit this remotely to upload malicious files.

Detection Guidance

Detecting this vulnerability may involve checking for unrestricted file uploads in the admin/update_food.php component. Look for unexpected or suspicious files in upload directories. Monitor network traffic for POST requests to this file with unusual parameters like 'cmd'. Use tools like Wireshark or tcpdump to inspect traffic.

Impact Analysis

An attacker could upload malicious files to the server, potentially leading to remote code execution, data theft, or system compromise. This could disrupt services or allow unauthorized access to sensitive information.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR (data protection) and HIPAA (health information privacy) requirements. Non-compliance may result in legal penalties and reputational damage.

Mitigation Strategies

Immediately restrict access to the admin/update_food.php file. Disable file uploads if not required. Implement strict file type and size validation. Update to the latest patched version if available. Monitor for signs of exploitation and block suspicious IP addresses.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-127283. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...