CVE-2026-86217: Information Disclosure in code-projects Hotel and Tourism Reservation in PHP

This vulnerability in code-projects Hotel and Tourism Reservation in PHP 1.0 involves an information disclosure issue in the Database Backup Handler component. The affected file is /ht/hotel_db (1).sql, and the flaw allows remote attackers to obtain sensitive information without requiring privileges or user interaction. The vulnerability has been publicly disclosed with exploit code available, but no patch or remediation details are provided.

Successful exploitation results in unauthorized information disclosure. The vulnerability can be exploited remotely without any authentication or user interaction, potentially exposing sensitive data contained in the database backup file. There is no indication of privilege escalation or system compromise beyond information disclosure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. In the absence of an official fix, restrict access to the affected file and the Database Backup Handler component to trusted users only. Monitor for any updates from the vendor regarding patches or mitigations.