CVE-2026-10558 describes a file inclusion vulnerability in SourceCodester Pizzafy Ecommerce System 1.0. The issue exists in the /admin/index.php file where the 'page' parameter can be manipulated to include arbitrary files. This vulnerability is remotely exploitable without user interaction and requires low privileges. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and low impacts on confidentiality, integrity, and availability. No official fix or vendor advisory is currently available.

Successful exploitation allows an attacker to include arbitrary files via the 'page' parameter in /admin/index.php, potentially leading to information disclosure or code execution depending on the included files. The impact is rated medium with limited confidentiality, integrity, and availability impact as per the CVSS vector. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the /admin directory, validating and sanitizing input parameters, or applying web application firewall rules to block malicious file inclusion attempts.