Is CVE-2026-116603 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-116603 being exploited in the wild.

How severe is CVE-2026-116603?

Medium severity, with a CVSS score of 4.7, published 27 October 2026.

Which products and versions are affected?

SourceCodester Online Food Ordering System 1.0.

How is CVE-2026-116603 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-116603?

Check whether you run SourceCodester Online Food Ordering System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-116603: SourceCodester Online Food Ordering System unrestricted file upload in add_food.php

CVE-2026-116603 · Severity: medium · CVSS 4.7 · Published 2026-10-27

SourceCodester Online Food Ordering System is a PHP web application for managing food orders and menu items. The admin panel's food upload feature does not validate file types, allowing an authenticated administrator to upload and execute arbitrary code on the server by uploading a PHP file disguised as an image. This can lead to complete server compromise and data theft.

Technologies: SourceCodester Online Food Ordering System. Vendors: SourceCodester.

Quick answers

Is CVE-2026-116603 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-116603 being exploited in the wild.
How severe is CVE-2026-116603?: Medium severity, with a CVSS score of 4.7, published 27 October 2026.
Which products and versions are affected?: SourceCodester Online Food Ordering System 1.0.
Is there a fix for CVE-2026-116603?: No fixed version is recorded yet. Enforce a strict image file extension allowlist (jpg, jpeg, png, gif, webp), validate uploaded files using getimagesize() or MIME type checking, and store uploads outside the web root or disable PHP execution in the upload directory via .htaccess or web server configuration. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-116603 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-116603?: Check whether you run SourceCodester Online Food Ordering System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Enforce a strict image file extension allowlist (jpg, jpeg, png, gif, webp), validate uploaded files using getimagesize() or MIME type checking, and store uploads outside the web root or disable PHP execution in the upload directory via .htaccess or web server configuration.

Technical details

An unrestricted file upload vulnerability (CWE-434) exists in admin/add_food.php where the image file extension is taken directly from the user-supplied filename without validation or allowlisting. The uploaded file is placed in the web-accessible images/food/ directory where PHP execution is enabled, allowing an attacker with admin credentials to upload a PHP shell and execute arbitrary OS commands. Similar vulnerabilities exist in admin/update_food.php and admin/update_category.php.

Affected products

SourceCodester Online Food Ordering System 1.0

Timeline

2026-10-27: disclosed: CVE-2026-116603 published
2026-10-10: other: Vulnerability discovered and reported as reproduced on local XAMPP instance

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.