CVE-2026-76995: Unrestricted Upload in SourceCodester Simple Online Food Ordering System

The vulnerability identified in SourceCodester Simple Online Food Ordering System 1.0 allows remote attackers to perform unrestricted file uploads by manipulating the img parameter in the /admin/ajax.php?action=save_menu endpoint. This could potentially allow an attacker to upload arbitrary files to the server. The CVSS 4.0 base score is 5.1 (medium severity), reflecting network attack vector, low complexity, no user interaction, and limited confidentiality, integrity, and availability impacts. Exploit code is publicly available, but no known active exploitation in the wild has been reported. No vendor advisory or patch information is currently available.

Successful exploitation allows remote attackers to upload arbitrary files to the affected system, which could lead to further compromise depending on the uploaded content and server configuration. The impact is rated medium with limited confidentiality, integrity, and availability effects as per the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the vulnerable endpoint, implement strict file upload validation, and monitor for suspicious upload activity. Avoid exposing the admin interface to untrusted networks.