Neethuharii CafeManagement contains a security vulnerability identified as CVE-2026-96513, which allows an attacker to perform unrestricted file uploads via the 'image' parameter in AddProductCode.php. This vulnerability is remotely exploitable without authentication or user interaction. The product's rolling release model means affected and fixed versions are not specified. The vendor has not provided any response or patch information. The CVSS 4.0 base score is 6.9, indicating medium severity with network attack vector, low complexity, and no privileges or user interaction required. Exploit code has been publicly released but no confirmed active exploitation is reported.

The vulnerability allows remote attackers to upload arbitrary files without restriction, potentially leading to unauthorized file storage on the server. This could facilitate further attacks such as remote code execution or defacement if malicious files are executed or accessed. The medium severity score reflects the significant risk posed by this flaw, although no confirmed exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch is available, users should consider implementing temporary mitigations such as restricting file upload types, validating and sanitizing file inputs, and monitoring for suspicious upload activity until an official fix is released.