CVE-2026-10694 describes a file inclusion vulnerability in SourceCodester Online Food Ordering System 2.0. The vulnerability exists in the include function of /index.php, where the 'page' argument can be manipulated to include unintended files. This flaw allows remote attackers to potentially execute arbitrary code or disclose sensitive information by including malicious or local files. The vulnerability has a CVSS 4.0 score of 6.9 (medium severity). There is no vendor advisory or patch currently available, and the product is not a cloud service, so remediation depends on the vendor or user applying fixes.

Successful exploitation of this vulnerability can lead to unauthorized file inclusion, which may result in remote code execution or information disclosure depending on the included files. The vulnerability is remotely exploitable without authentication and requires no user interaction. The medium CVSS score reflects the potential for significant impact but with some limitations in exploit complexity or scope.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. In the absence of an official fix, users should consider implementing input validation and sanitization on the 'page' parameter to prevent arbitrary file inclusion. Restricting file inclusion to a whitelist of allowed files or disabling dynamic file inclusion altogether can mitigate risk. Monitor vendor channels for updates or patches.