Is CVE-2026-86217 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-86217 being exploited in the wild.

How severe is CVE-2026-86217?

Medium severity, with a CVSS score of 5.3, published 6 September 2026.

Which products and versions are affected?

Code-Projects Hotel and Tourism Reservation 1.0.

Is there a fix for CVE-2026-86217?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-86217 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-86217?

Check whether you run Code-Projects Hotel and Tourism Reservation at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-86217: code-projects Hotel and Tourism Reservation information disclosure via exposed SQL file

CVE-2026-86217 · Severity: medium · CVSS 5.3 · Published 2026-09-06

Hotel and Tourism Reservation is a PHP-based hotel booking system used by businesses to manage reservations and customer data. The application stores its SQL database backup file in a web-accessible directory, allowing unauthenticated attackers to download the database and access sensitive information including customer details, booking records, and potentially credentials.

Vendors: Code-Projects.

Quick answers

Is CVE-2026-86217 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-86217 being exploited in the wild.
How severe is CVE-2026-86217?: Medium severity, with a CVSS score of 5.3, published 6 September 2026.
Which products and versions are affected?: Code-Projects Hotel and Tourism Reservation 1.0.
Is there a fix for CVE-2026-86217?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-86217 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-86217?: Check whether you run Code-Projects Hotel and Tourism Reservation at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability is an information disclosure flaw caused by improper file placement—a SQL database backup file (hotel_db.sql) is stored in the web root directory (/ht/) and is directly accessible via HTTP GET requests without authentication. The vulnerable component is the Database Backup Handler, which fails to restrict access to database files. An unauthenticated remote attacker can discover and download the SQL file, gaining read access to the entire database structure and contents. The attack requires no special privileges or user interaction and can be executed remotely. Remediation involves removing SQL files from the web root, storing databases outside the document root, and implementing access controls via web server configuration.

Affected products

code-projects Hotel and Tourism Reservation 1.0

Timeline

2026-09-06: disclosed
exploited: exploit is public and may be used

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.