Robo Cafe RMS CVE-2026-102263

Requires an authenticated high-privilege (admin) account able to reach the manage-food.php food-management upload function (PR:H) - this is NOT unauthenticated. Given an admin session, no user interaction is needed (UI:N) and the attack is remote over the network (AV:N/AC:L). The primary limiting factor is the admin-authentication prerequisite; secondary factors are the product's rolling-release nature (no fixed version to target) and its very small deployment base. Successful weaponization also assumes the server executes uploaded PHP from the upload directory.

This is a CWE-434 unrestricted file upload in mwasikz robo-cafe-rms (manage-food.php), rated CVSS 4.0 5.1 (Medium) by VulDB. The vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N indicates a network-reachable, low-complexity flaw but requiring HIGH privileges (PR:H) - i.e., the manage-food admin function is only reachable by an already-authenticated high-privilege user, which is the single most important limiting factor and the reason the score is only Medium despite file-upload's RCE potential. Exploitation status: publicly available exploit code exists (E:P / 'exploit disclosed to the public'), but there is NO CISA KEV listing and NO EPSS score in the provided data, so there is no evidence of active or widespread exploitation - POC availability and active exploitation are distinct signals. The vendor's own impact rating (VC:L/VI:L/VA:L) is arguably conservative: an unrestricted upload that permits a PHP webshell typically yields full compromise (C/I/A:H); this is a notable discrepancy to verify against the POC. Overall this is a low-to-medium real-world priority: the PR:H barrier plus the obscure, tiny-footprint product outweigh the public POC.

An attacker who already holds an authenticated high-privilege (admin) session on a robo-cafe-rms deployment abuses the food-management upload in manage-food.php to upload a malicious PHP file (e.g., a webshell) instead of a menu image, then requests that file to execute code on the server. A public exploit has been disclosed, lowering the effort to reproduce, though the attacker must first possess admin credentials.