Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.5
CVE-2026-116602: SourceCodester Online Food Ordering System lets attackers delete any file
CVE-2026-116602 · published 9 days ago
Summary
The delete.php function in the online food ordering system does not properly check the file name it receives, so a remote user can change the image_name parameter to point to any location on the server. This allows an attacker to remove or overwrite important files, potentially disrupting the website or exposing data. Update to the latest version or apply a fix that validates and sanitizes the file path, and limit the web server's file permissions to only the necessary directories.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| sourcecodester | online food ordering system | 1.0 |
Original advisory text
SourceCodester Online Food Ordering System delete.php unlink path traversal
A vulnerability was detected in SourceCodester Online Food Ordering System 1.0. This issue affects the function unlink of the file admin/delete.php. Performing a manipulation of the argument image_name results in path traversal. The attack is possible to be carried out remotely. The exploit is now public and may be used.
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Severity
5.5
Medium
Type
CWE-22Path Traversal
Timeline
Published26 Oct 2026
Updated4 Nov 2026
First seen26 Oct 2026
Track software like this
Free during beta