The vulnerability CVE-2026-10558 affects SourceCodester Pizzafy Ecommerce System 1.0. It arises from improper handling of the 'page' parameter in the /admin/index.php file, allowing an attacker to perform file inclusion remotely. This flaw could enable an attacker to include arbitrary files, potentially leading to information disclosure or further compromise. The CVSS 4.0 base score is 5.3, reflecting medium severity with network attack vector, low complexity, no privileges required, and no user interaction needed. The vulnerability has been publicly disclosed, but no official patch or vendor advisory is available at this time.

Successful exploitation of this vulnerability could allow an attacker to include arbitrary files on the server, which may lead to information disclosure or other impacts depending on the included files. The attack can be performed remotely without authentication or user interaction. However, the overall impact is rated medium based on the CVSS score and available details. There is no evidence of active exploitation in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix is currently available, it is recommended to monitor vendor communications for updates. In the meantime, restricting access to the /admin directory and validating or sanitizing input parameters such as 'page' can help reduce exposure. Avoid exposing the admin interface to untrusted networks if possible.