SourceCodester Food Ordering System: Unrestricted File Upload (CVE-2026-127283)
SourceCodester Food Ordering System 1.0 contains an unrestricted file upload vulnerability in the admin/update_food.php file.
CVE search metadata
CVE search record: CVE-2026-127283. Severity: high. CVSS: 7.3. KEV: no. Product: Food Ordering System 1.0. Brief: SourceCodester Food Ordering System: Unrestricted File Upload (CVE-2026-127283). Brief link: https://feed.craftedsignal.io/briefs/2026-11-food-ordering-system-rce-cve-2026-127283/
Triage facts
Revision 1- Applicability
- Food Ordering System 1.0
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 13, 02:45 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
SourceCodester Food Ordering System 1.0 is vulnerable to an unrestricted file upload via the 'cmd' argument in the 'admin/update_food.php' script of the Admin Image Handler component. This vulnerability is remotely exploitable and a public exploit is available.
Threat Hunt
Identify suspicious HTTP POST requests directed at 'admin/update_food.php' where the 'cmd' parameter contains unusual strings or evidence of file upload attempts.
Data: Web server access logs, HTTP request body logs