CVE-2026-86217
Received Received - Intake

Database Backup Handler Information Disclosure in Hotel and Tourism Reservation PHP

Publication date: 2026-09-06

Last updated on: 2026-09-06

Assigner: VulDB

Description
A vulnerability was detected in code-projects Hotel and Tourism Reservation in PHP 1.0. Affected is an unknown function of the file /ht/hotel_db%20(1).sql of the component Database Backup Handler. The manipulation results in information disclosure. The attack may be launched remotely. The exploit is now public and may be used.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-06
Last Modified
2026-09-06
Generated
2026-09-06
AI Q&A
2026-09-06
EPSS Evaluated
N/A
NVD
CVE-2026-86217
EUVD
EUVD-2026-72138

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-86217 is a vulnerability in the Hotel and Tourism Reservation System written in PHP. It involves a sensitive information disclosure issue where an SQL database backup file named 'hotel_db (1).sql' is stored in a publicly accessible web directory (/ht/). If the web server allows direct access to .sql files, an attacker can retrieve this file via an HTTP GET request to '/ht/hotel_db%20(1).sql'.

Detection Guidance

Check if the file /ht/hotel_db%20(1).sql is accessible via a web browser or curl command. Use: curl -I http://yourdomain.com/ht/hotel_db%20(1).sql. If the server returns a 200 OK status, the file is exposed and vulnerable.

Impact Analysis

This vulnerability allows unauthenticated attackers to access sensitive database information, including user accounts, reservation data, hotel details, and potentially credentials or personal data if stored in the database dump. This can lead to data breaches, identity theft, or unauthorized access to the system.

Compliance Impact

This vulnerability can lead to non-compliance with GDPR and HIPAA due to the exposure of personal and sensitive data. GDPR requires protection of personal data, while HIPAA mandates safeguards for protected health information. A breach could result in legal penalties, fines, and reputational damage.

Mitigation Strategies

Remove the exposed SQL file from the web directory. Move database backups outside the document root. Configure the web server to deny access to .sql files by adding rules in .htaccess or server config to block such requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86217. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart