Is CVE-2026-13553 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-13553 being exploited in the wild.

How severe is CVE-2026-13553?

High severity, with a CVSS score of 7.3, published 29 June 2026.

Which products and versions are affected?

Itsourcecode Online Hotel Management System 1.0.

Is there a fix for CVE-2026-13553?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-13553 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-13553?

Check whether you run Itsourcecode Online Hotel Management System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-13553: itsourcecode Online Hotel Management System unrestricted upload in mod_amenities

CVE-2026-13553 · Severity: high · CVSS 7.3 · Published 2026-06-29

A vulnerability exists in the itsourcecode Online Hotel Management System, a software package used for managing hotel operations. An attacker can upload malicious files to the server without needing to log in. This could allow a remote attacker to take full control of the server, steal sensitive guest data, or disrupt hotel operations.

Technologies: Itsourcecode Online Hotel Management System. Vendors: Itsourcecode.

Quick answers

Is CVE-2026-13553 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-13553 being exploited in the wild.
How severe is CVE-2026-13553?: High severity, with a CVSS score of 7.3, published 29 June 2026.
Which products and versions are affected?: Itsourcecode Online Hotel Management System 1.0.
Is there a fix for CVE-2026-13553?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-13553 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-13553?: Check whether you run Itsourcecode Online Hotel Management System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An arbitrary file upload vulnerability exists in /admin/mod_amenities/controller.php?action=add due to insufficient validation of the 'image' parameter. The application fails to properly verify file extensions and content, relying on easily spoofed 'Content-Type' and 'Content-Disposition' headers. An unauthenticated remote attacker can exploit this by sending a specially crafted POST request containing a PHP shell disguised as an image file. Once uploaded, the script can be accessed directly via the web server, allowing for remote code execution (RCE) and full server takeover. A public proof-of-concept (PoC) is available.

Affected products

itsourcecode Online Hotel Management System 1.0

Timeline

2026-05-30: disclosed: Vulnerability details and PoC shared on GitHub.
2026-06-29: advisory: CVE-2026-13553 published.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.