Pizzafy Ecommerce System CVE-2026-16226

Q: What is the CVSS score of CVE-2026-16226?

CVE-2026-16226 has a CVSS 4.0 base score of 5.1 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-45436 MEDIUM

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-07-19 VulDB

GHSA-vgm7-3r62-6qq5

File Upload PHP Pizzafy Ecommerce System

5.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.1 CRITICAL

Network-accessible admin panel (AV:N, AC:L) requires admin credentials (PR:H); webshell upload enables scope change with full OS-level C/I/A impact if upload directory permits PHP execution.

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 19, 2026 - 08:51 vuln.today

DescriptionCVE.org

A weakness has been identified in SourceCodester Pizzafy Ecommerce System 1.0. This affects the function save_settings of the file /admin/admin_class_novo.php. This manipulation of the argument img causes unrestricted upload. The attack is possible to be carried out remotely.

AnalysisAI

Unrestricted file upload in SourceCodester Pizzafy Ecommerce System 1.0 exposes the admin panel's save_settings function to arbitrary file upload via the img parameter in /admin/admin_class_novo.php. The CVSS 4.0 vector (PR:H) confirms exploitation requires authenticated administrator-level access, but once achieved, a PHP webshell can be uploaded to the server and potentially executed, escalating effective impact well beyond the base score's conservative VC:L/VI:L ratings. No public exploit code and no CISA KEV listing exist at time of analysis.

Technical ContextAI

The vulnerability resides in the PHP-based Pizzafy Ecommerce System, an open-source e-commerce application distributed by SourceCodester, primarily targeting student and hobbyist deployments. CWE-434 (Unrestricted Upload of File with Dangerous Type) describes the root cause: the save_settings function within /admin/admin_class_novo.php accepts the img argument without enforcing MIME type validation, file extension allowlisting, or magic-byte inspection. In PHP environments, this class of flaw classically permits an attacker to upload a .php webshell file; if the upload directory is web-accessible and the server executes PHP scripts within it, arbitrary server-side command execution follows. The affected CPE is cpe:2.3:a:sourcecodester:pizzafy_ecommerce_system:*:*:*:*:*:*:*:*, with the wildcard version field suggesting all available versions may be affected, though version 1.0 is the only explicitly confirmed release.

RemediationAI

No vendor-released patch has been identified at time of analysis - monitor https://vuldb.com/vuln/380048 and https://www.sourcecodester.com/ for updates. As an immediate compensating control, restrict the save_settings upload handler in /admin/admin_class_novo.php to allowlist safe image MIME types (image/jpeg, image/png, image/gif, image/webp) and validate file extensions server-side, rejecting any submission containing executable extensions such as .php, .php5, .phtml, or .phar. Separately and critically, ensure the upload storage directory is configured to deny server-side script execution - in Apache via .htaccess with php_flag engine off, in nginx via location blocks that omit PHP FastCGI passthrough - so that even a successfully uploaded file cannot be invoked. Restrict administrative panel access to trusted IP ranges at the network or web server layer to reduce exposure of the /admin/ path. Note that IP allowlisting does not remediate the vulnerability but raises the bar for exploitation significantly given the PR:H prerequisite.