Executive brief
SourceCodester Pet Grooming Management Software is a web application used to manage pet service businesses. A security flaw in the administrative interface allows unauthorized individuals to view internal file and directory structures. This could lead to the exposure of sensitive configuration details or system information, potentially aiding further attacks against the business.
Technical details
A directory traversal vulnerability exists in SourceCodester Pet Grooming Management Software 1.0. The application fails to properly validate user-supplied input or restrict access to administrative subdirectories, specifically within /admin/include, /admin/operation, and /admin/assets. A remote, unauthenticated attacker can exploit this by directly accessing these paths to list files and directories. This exposure of sensitive information (CWE-200, CWE-538) can reveal the application's internal structure and configuration. A proof-of-concept exploit has been publicly disclosed.
Affected products
- SourceCodester Pet Grooming Management Software 1.0
Timeline
- 2026-05-09: disclosed: Vulnerability reported on GitHub by Zheng Yunpeng
- 2026-06-01: advisory: CVE-2026-10254 published by VulDB/NVD