CVE-2026-10559 is a file inclusion vulnerability in SourceCodester Pizzafy Ecommerce System 1.0. The vulnerability arises from improper handling of the 'page' parameter in the /index.php file, which can be manipulated remotely to include arbitrary files. This can potentially lead to information disclosure or code execution depending on the included files. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and low to limited impacts on confidentiality, integrity, and availability. No vendor-provided patch or official remediation is currently documented.

Successful exploitation can allow an attacker to include arbitrary files on the server, potentially leading to information disclosure or further code execution. The impact is rated medium with limited confidentiality, integrity, and availability impacts as per the CVSS 4.0 vector. There are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing input validation or filtering on the 'page' parameter to prevent file inclusion. Monitor vendor channels for updates or patches addressing this vulnerability.