---
id: CVE-2026-127283
title: >-
  SourceCodester Food Ordering System Admin Image update_food.php unrestricted
  upload
summary: >-
  A vulnerability was identified in SourceCodester Food Ordering System 1.0.
  Affected by this issue is some unknown functionality of the file
  admin/update_food.php of the component Admin Image Handler. Such manipulation
  of the argument cmd…
severity: high
cvss: 7.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'
cvssSource: cna
cwe:
  - CWE-434
  - CWE-284
vendor: SourceCodester
product: Food Ordering System
affected:
  - food_ordering_system 1.0
published: '2026-11-13'
updated: '2026-11-13'
sourceUpdated: '2026-11-13T01:45:20.555Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-127283'
references:
  - url: 'https://vuldb.com/vuln/436449'
    label: >-
      VDB-436449 | SourceCodester Food Ordering System Admin Image
      update_food.php unrestricted upload
  - url: 'https://vuldb.com/vuln/436449/cti'
    label: 'VDB-436449 | CTI Indicators (IOB, IOC, TTP, IOA)'
  - url: 'https://vuldb.com/cve/CVE-2026-127283'
    label: CVE-2026-127283 | CVE Analysis and Report
  - url: 'https://vuldb.com/submit/1041048'
    label: >-
      Submit #1041048 | SourceCodester Food Ordering System in PHP and MySQL 1.0
      Unrestricted File Upload Leading to Remote Code Execution
  - url: >-
      https://github.com/yuechuya/sourcecodester-vuln-reports/blob/main/reports/Food-Ordering-System/VULN-F1-Unauth-File-Upload-RCE.md
  - url: 'https://www.sourcecodester.com/'
tags:
  - cve.org
ingestedAt: '2026-11-13T02:19:56.905Z'
---

## Overview

A vulnerability was identified in SourceCodester Food Ordering System 1.0. Affected by this issue is some unknown functionality of the file admin/update_food.php of the component Admin Image Handler. Such manipulation of the argument cmd leads to unrestricted upload. The attack may be performed from remote. The exploit is publicly available and might be used.

## Affected

- `food_ordering_system 1.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.