CVE-2026-16226 describes an unrestricted file upload vulnerability in SourceCodester Pizzafy Ecommerce System 1.0. The issue exists in the save_settings function of the /admin/admin_class_novo.php file, where the img parameter can be manipulated to upload arbitrary files. This flaw can be exploited remotely by an attacker with high privileges, potentially leading to unauthorized file uploads. No official fix or patch has been documented at this time.

An attacker with high privileges can remotely upload arbitrary files through the vulnerable img parameter, which may lead to further compromise depending on the nature of the uploaded files. The CVSS 4.0 base score is 5.1 (medium), reflecting the network attack vector, low complexity, no user interaction, but requiring high privileges. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected functionality to trusted administrators only and monitor for suspicious file uploads. Avoid exposing the vulnerable interface to untrusted networks.