CVE-2026-10559 is a file inclusion vulnerability affecting SourceCodester Pizzafy Ecommerce System 1.0. The vulnerability exists due to insufficient validation or sanitization of the 'page' parameter in /index.php, which can be manipulated remotely to include arbitrary files. This could potentially allow attackers to execute unauthorized code or disclose sensitive information depending on the included files. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and low to limited impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability may allow remote attackers to include and potentially execute arbitrary files on the affected system. This could lead to unauthorized code execution or information disclosure. However, the impact is rated medium due to limited scope and complexity factors as indicated by the CVSS score of 5.3. There are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is currently available, users should monitor vendor communications for updates. As a temporary measure, restricting access to the vulnerable parameter or implementing input validation and sanitization on the 'page' argument may reduce risk.