CVE-2026-116602
SourceCodester Online Food Ordering System delete.php unlink path traversal
SourceCodester Online Food Ordering System
CVSS
6.9MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
A vulnerability was detected in SourceCodester Online Food Ordering System 1.0. This issue affects the function unlink of the file admin/delete.php. Performing a manipulation of the argument image_name results in path traversal. The attack is possible to be carried out remotely. The exploit is now public and may be used.
Text from CVE List
Affected versions 1
- Online Food Ordering Systemaffected: 1.0CVE List
References 6
- vuldb.com/cve/CVE-2026-116602Advisoryvia CVE List
- vuldb.com/submit/1022943Advisoryvia CVE List
- github.com/CyberShailendra/sourcecodesterArbitraryFileDeletion-via-PathTraversalExploitvia CVE List
- vuldb.com/vuln/426508Referencevia CVE List
- vuldb.com/vuln/426508/ctiReferencevia CVE List
- sourcecodester.com/Referencevia CVE List