# CVE-2026-86217: code-projects Hotel and Tourism Reservation information disclosure via exposed SQL file

Source: https://junglewise.ai/threats/cve-2026-86217-code-projects-hotel-and-tourism-reservation-information  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-06. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-86217 · Severity: medium · CVSS 5.3 · Published 2026-09-06

Hotel and Tourism Reservation is a PHP-based hotel booking system used by businesses to manage reservations and customer data. The application stores its SQL database backup file in a web-accessible directory, allowing unauthenticated attackers to download the database and access sensitive information including customer details, booking records, and potentially credentials.

Vendors: [Code-Projects](https://junglewise.ai/threats/vendors/code-projects).

## Quick answers

**Is CVE-2026-86217 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-86217 being exploited in the wild.

**How severe is CVE-2026-86217?** Medium severity, with a CVSS score of 5.3, published 6 September 2026.

**Which products and versions are affected?** Code-Projects Hotel and Tourism Reservation 1.0.

**Is there a fix for CVE-2026-86217?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-86217 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-86217?** Check whether you run Code-Projects Hotel and Tourism Reservation at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability is an information disclosure flaw caused by improper file placement—a SQL database backup file (hotel_db.sql) is stored in the web root directory (/ht/) and is directly accessible via HTTP GET requests without authentication. The vulnerable component is the Database Backup Handler, which fails to restrict access to database files. An unauthenticated remote attacker can discover and download the SQL file, gaining read access to the entire database structure and contents. The attack requires no special privileges or user interaction and can be executed remotely. Remediation involves removing SQL files from the web root, storing databases outside the document root, and implementing access controls via web server configuration.

## Affected products

- code-projects Hotel and Tourism Reservation 1.0

## Timeline

- 2026-09-06: disclosed
- exploited: exploit is public and may be used

## References

- [https://code-projects.org/](https://code-projects.org/)
- [https://github.com/ahmadmarz10-hub/CVEsMarz/blob/main/Hotel%20and%20Tourism%20Reservation%20System%20%E2%80%93%20Sensitive%20Information%20Disclosure%20via%20Exposed%20SQL%20Database%20File.md](https://github.com/ahmadmarz10-hub/CVEsMarz/blob/main/Hotel%20and%20Tourism%20Reservation%20System%20%E2%80%93%20Sensitive%20Information%20Disclosure%20via%20Exposed%20SQL%20Database%20File.md)

## Related threats

- [code-projects Hotel and Tourism Reservation reflected XSS in room parameter](https://junglewise.ai/threats/cve-2026-86216-code-projects-hotel-and-tourism-reservation-reflected-xss-in-room)