CVE-2026-127283

CVSS 7.3 (high) · published 2026-11-13

A vulnerability was identified in SourceCodester Food Ordering System 1.0. Affected by this issue is some unknown functionality of the file admin/update_food.php of the component Admin Image Handler. Such manipulation of the argument cmd leads to unrestricted upload. The attack may be performed from remote. The exploit is publicly available and might be used.

Weakness: CWE-284, CWE-434

Source: NVD CVE-2026-127283

References

• https://github.com/yuechuya/sourcecodester-vuln-reports/blob/main/reports/Food-Ordering-System/VULN-F1-Unauth-File-Upload-RCE.md
• https://vuldb.com/cve/CVE-2026-127283
• https://vuldb.com/submit/1041048
• https://vuldb.com/vuln/436449
• https://vuldb.com/vuln/436449/cti
• https://www.sourcecodester.com/

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.