Is there a patch available for CVE-2026-8802?

Yes, a patch is available for CVE-2026-8802. Update the affected software to the latest version immediately.

Open Source Point of Sale CVE-2026-8802

Q: What is the CVSS score of CVE-2026-8802?

CVE-2026-8802 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-30761 MEDIUM

Path Traversal (CWE-22)

2026-05-18 VulDB

GHSA-pmmv-883q-cfwq

Path Traversal PHP

5.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

May 18, 2026 - 11:30 vuln.today

Analysis Generated

May 18, 2026 - 11:30 vuln.today

CVSS changed

May 18, 2026 - 11:22 NVD

4.3 (MEDIUM) 5.3 (MEDIUM)

DescriptionCVE.org

A vulnerability was detected in opensourcepos Open Source Point of Sale up to 3.4.2. This issue affects the function getPicThumb of the file app/Controllers/Items.php. The manipulation of the argument pic_filename results in path traversal. The attack may be launched remotely. The patch is identified as def0c27a0e252668df8d942fc31e16d1edfd7323. A patch should be applied to remediate this issue. The vendor was contacted early about this disclosure.

AnalysisAI

Path traversal in opensourcepos Open Source Point of Sale versions 3.4.0 through 3.4.2 allows authenticated remote attackers to read arbitrary image files outside the intended directory via manipulated pic_filename parameters in the getPicThumb controller function. The vulnerability has CVSS 5.3 (Medium) with low attack complexity requiring only low-privilege authentication. Vendor-released patch available via GitHub commit def0c27a0e252668df8d942fc31e16d1edfd7323. No public exploit or active exploitation confirmed at time of analysis, though the fix is publicly documented with code diff showing the vulnerable parameter handling.

Technical ContextAI

This vulnerability exists in the Items.php controller's getPicThumb() function, which generates thumbnail images for point-of-sale product records. The affected code uses rawurldecode() on user-supplied pic_filename parameters without sanitization, allowing directory traversal sequences like '../' to escape the intended uploads directory. This is a classic CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) implementation flaw in PHP file handling. The affected product opensourcepos/opensourcepos is a web-based PHP retail management system built on CodeIgniter 4 framework. The function returns image file contents via HTTP response, making it a confidentiality exposure vector rather than arbitrary file execution. The CVSS 4.0 vector confirms network-accessible attack surface (AV:N) with low complexity (AC:L) but requires authenticated access (PR:L), limiting impact to low confidentiality breach (VC:L) with no integrity or availability impact.

RemediationAI

Apply vendor-released patch by upgrading to opensourcepos version 3.4.3 or later, which incorporates commit def0c27a0e252668df8d942fc31e16d1edfd7323 from GitHub PR #4545 (https://github.com/opensourcepos/opensourcepos/pull/4545). The fix implements basename() sanitization to strip directory traversal sequences and adds file extension validation against configured image types. For systems unable to upgrade immediately, implement compensating controls: restrict file system permissions on the web application directory to prevent reading sensitive files outside uploads (specifically deny read access to /etc/, /var/, application config directories); enforce strict authentication policies and review user privilege levels to minimize PR:L access; deploy web application firewall rules to detect and block URL-encoded path traversal patterns (%2e%2e%2f, ../, etc.) in pic_filename parameters sent to /items/getPicThumb endpoint. Note that WAF rules may cause false positives if legitimate filenames contain periods or encoded characters. Monitor application logs for HTTP 400 responses from getPicThumb after patching, as the new validation rejects invalid file types. Advisory references: https://github.com/opensourcepos/opensourcepos/security/advisories/GHSA-xq63-3v4g-39r5 and commit details at https://github.com/opensourcepos/opensourcepos/commit/def0c27a0e252668df8d942fc31e16d1edfd7323.