SourceCodester Food Ordering EUVD-2026-110507

Exploitation requires reaching the admin/delete.php endpoint and supplying an image_name value containing path-traversal sequences that the unlink() call then acts on, deleting files outside the intended image directory. The impact is limited to file deletion (integrity and availability) with no data disclosure. The key limiting/unverified factor is access control on the admin endpoint: the input vector claims PR:N (no authentication) but the file resides under admin/, which normally implies an authenticated administrative context; the sources do not confirm whether authentication is enforced, so whether this is truly unauthenticated or admin-only is unconfirmed. No fixed version or mitigation is stated in the available evidence.

This is a medium-severity, low-urgency issue rather than a top priority. The input CVSS 4.0 base vector (AV:N/AC:L/AT:N/PR:N/UI:N) with VI:L/VA:L corresponds to a ~5.3 medium score, and the impact is confined to integrity and availability via arbitrary file deletion - there is no confidentiality impact (VC:N) and no scope change (SC:N/SI:N/SA:N). EPSS is low at 0.47% (40th percentile), the vulnerability is NOT in CISA KEV, and the vuln.today decision label is 'this_month' (not act_now/emergency), so all decision signals point to routine, scheduled remediation rather than crisis response. One signal to reconcile: the input vector asserts PR:N (unauthenticated), yet the vulnerable file is admin/delete.php, whose path implies it is an administrative function that would normally sit behind authentication. The available sources do not state whether access control is enforced on this endpoint, so the true privilege requirement is unverified - this materially affects real-world risk (unauthenticated vs. admin-only) and should be confirmed against the actual code or vendor. A GitHub reference tagged as an exploit is present, but it is a reference only and not verified as working exploit code.

A remote attacker sends a request to admin/delete.php supplying a crafted image_name value containing directory-traversal sequences (e.g. ../../), causing the application's unlink() call to delete a file outside the intended image directory. Repeatedly abusing this could remove configuration files, uploaded content, or application scripts, degrading integrity and availability. A public PoC reference exists on GitHub but is not verified as working exploit code.