The vulnerability CVE-2026-13553 affects itsourcecode Online Hotel Management System version 1.0. It arises from insufficient validation of the image parameter in the add action of the amenities controller, allowing an attacker to upload arbitrary files without restriction. This can be exploited remotely without any privileges or user interaction. The vulnerability has a CVSS 4.0 base score of 6.9, indicating a medium severity level. No vendor advisory or patch is currently published, and no known exploits are reported in the wild.

Successful exploitation of this vulnerability could allow an attacker to upload arbitrary files to the server, potentially leading to unauthorized code execution or system compromise depending on the uploaded file and server configuration. The vulnerability is remotely exploitable without authentication, increasing its risk. However, the lack of known exploits in the wild and medium CVSS score suggest moderate immediate risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected endpoint and implement additional validation or filtering on uploaded files as a temporary mitigation. Monitor for vendor updates regarding patches or official mitigations.