The vulnerability CVE-2026-9445 affects SourceCodester Simple POS and Inventory System 1.0. It is caused by improper validation of the 'image' argument in the /admin/addproduct.php file, specifically within the File Extension Handler component. This allows an attacker to perform unrestricted file uploads remotely, bypassing intended file type restrictions. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity with network attack vector, low complexity, no privileges required, and no user interaction needed. Although an exploit has been published, there is no evidence of widespread exploitation. No official patch or vendor advisory is available at this time.

Successful exploitation allows an attacker to upload arbitrary files to the affected system remotely. This could lead to unauthorized file placement, potentially enabling further attacks such as code execution or system compromise depending on the uploaded file and system configuration. The medium CVSS score reflects a moderate risk due to ease of exploitation and potential impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the affected functionality, implementing additional file upload validation controls, or disabling the vulnerable upload feature if possible. Monitor for updates from SourceCodester regarding patches or official mitigations.