# CVE-2026-16226: SourceCodester Pizzafy Ecommerce System unrestricted upload in save_settings

Source: https://junglewise.ai/threats/cve-2026-16226-sourcecodester-pizzafy-ecommerce-system-unrestricted-upload-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-19. Updated: 2026-07-19  
License: CC BY 4.0 with a link back

CVE-2026-16226 · Severity: medium · CVSS 4.7 · Published 2026-07-19

SourceCodester Pizzafy Ecommerce System, a web application for managing online pizza sales, contains a security flaw in its administrative settings. An attacker with administrative access can upload malicious files to the server, potentially leading to a complete takeover of the website or disruption of business operations. This could result in the theft of customer data or the defacement of the online store.

Technologies: [SourceCodester Pizzafy Ecommerce System](https://junglewise.ai/threats/technologies/pizzafy-ecommerce-system). Vendors: [SourceCodester](https://junglewise.ai/threats/vendors/sourcecodester).

## Quick answers

**Is CVE-2026-16226 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-16226 being exploited in the wild.

**How severe is CVE-2026-16226?** Medium severity, with a CVSS score of 4.7, published 19 July 2026.

**Which products and versions are affected?** SourceCodester Pizzafy Ecommerce System 1.0.

**Is there a fix for CVE-2026-16226?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-16226 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-16226?** Check whether you run SourceCodester Pizzafy Ecommerce System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An unrestricted file upload vulnerability exists in SourceCodester Pizzafy Ecommerce System 1.0 within the save_settings function of /admin/admin_class_novo.php. The vulnerability is triggered by manipulating the 'img' argument, which fails to properly validate file types or extensions before saving them to the server. A remote attacker with high-level privileges (administrator) can exploit this to upload and execute arbitrary code, such as a PHP web shell. This can lead to full system compromise, unauthorized data access, or service disruption. No official patch has been identified at this time.

## Affected products

- SourceCodester Pizzafy Ecommerce System 1.0

## Timeline

- 2026-07-19: disclosed: Initial vulnerability publication

## References

- [https://vuldb.com/cve/CVE-2026-16226](https://vuldb.com/cve/CVE-2026-16226)
- [https://vuldb.com/submit/858229](https://vuldb.com/submit/858229)
- [https://vuldb.com/vuln/380048](https://vuldb.com/vuln/380048)
- [https://vuldb.com/vuln/380048/cti](https://vuldb.com/vuln/380048/cti)
- [https://www.sourcecodester.com/](https://www.sourcecodester.com/)

## Related threats

- [SourceCodester Pizzafy Ecommerce System local file inclusion in index.php](https://junglewise.ai/threats/cve-2026-10559-sourcecodester-pizzafy-ecommerce-system-local-file-inclusion-in)
- [SourceCodester Pizzafy Ecommerce System LFI in admin/index.php](https://junglewise.ai/threats/cve-2026-10558-sourcecodester-pizzafy-ecommerce-system-lfi-in-admin-index-php)
- [SourceCodester Pizzafy Ecommerce System XSS in save_user](https://junglewise.ai/threats/cve-2026-7297-sourcecodester-pizzafy-ecommerce-system-xss-in-save-user)
- [SourceCodester Pizzafy Ecommerce System XSS in save_order](https://junglewise.ai/threats/cve-2026-7296-sourcecodester-pizzafy-ecommerce-system-xss-in-save-order)
- [SourceCodester Pizzafy Ecommerce System XSS in save_menu](https://junglewise.ai/threats/cve-2026-7295-sourcecodester-pizzafy-ecommerce-system-xss-in-save-menu)