CVE-2026-10694: Remote File Inclusion in SourceCodester Online Food Ordering System 2.0

Technical summary

CVE-2026-10694 is a remote file inclusion (RFI) / local file inclusion (LFI) vulnerability stemming from improper input validation on the 'page' parameter processed by the include() function in /index.php of SourceCodester Online Food Ordering System 2.0. The application fails to sanitize or restrict the page argument, allowing an attacker to manipulate the file inclusion logic. The vulnerability is classified under CWE-73 (External Control of File Name or Path). With a CVSS v3.1 score of 7.3 (HIGH), the attack vector is network-based, requires no authentication or user interaction, and can result in confidentiality, integrity, and availability impacts.

Business impact

Successful exploitation could allow attackers to read sensitive files from the server (such as configuration files containing database credentials), modify application behavior, inject malicious code, or execute arbitrary operations with the privileges of the web server process. For food ordering systems, this could expose customer payment information, personal delivery addresses, and business operational data. Additionally, attackers could use the compromised system as a pivot point for lateral movement within the network or deploy malware.

Affected systems

SourceCodester Online Food Ordering System version 2.0 is confirmed vulnerable. Organizations running this application in production environments should assume they are at risk. The vulnerability affects all instances of the affected version regardless of deployment configuration, since exploitation requires no authentication or special privileges.

Exploitability

This vulnerability is highly exploitable. The attack surface is trivial—exploitation requires only crafting a URL with a malicious page parameter and sending an HTTP request. No authentication is required, no user interaction is necessary, and the exploit can be launched entirely remotely. Public exploit code is available, meaning threat actors have ready-to-use tools. The low complexity and absence of prerequisites make this vulnerability attractive to both opportunistic and targeted attackers.

Remediation

Upgrade SourceCodester Online Food Ordering System to a patched version released after June 17, 2026 (verify the exact version against the vendor advisory). If an immediate upgrade is not possible, implement strict input validation on the page parameter to reject path traversal sequences (../, ..\ etc.) and restrict includes to a whitelist of allowed files. Consider disabling dynamic file inclusion altogether in favor of a switch statement or routing mechanism. Apply network-level controls to restrict access to the application if it is not required to be internet-facing.

Patch guidance

Contact SourceCodester or monitor their official release channels for a security patch addressing CVE-2026-10694. The vulnerability was published on June 3, 2026 and modified on June 17, 2026; patch releases may have been issued around or after these dates. Verify the specific patched version number against the vendor's security advisory before deployment. Testing in a non-production environment is recommended prior to applying patches to production systems.

Detection guidance

Monitor web server access logs for suspicious patterns in the page parameter, such as path traversal sequences (../, ..\ , …./ ), encoded variants (%2e%2e), protocol schemes (http://, ftp://), or attempts to access sensitive files (/etc/passwd, config files). Intrusion detection systems should flag requests to /index.php with anomalous page values. Application-level logging of included files can help identify exploitation attempts. Network-based detection tools should look for characteristics consistent with file inclusion attacks.

Why prioritize this

Despite not being on the KEV catalog, this vulnerability warrants immediate remediation due to its HIGH CVSS score (7.3), public exploit availability, lack of authentication requirements, and ease of exploitation. File inclusion vulnerabilities are frequently exploited in attacks against web applications, and their presence on internet-facing systems creates substantial risk. The straightforward attack vector combined with real-world impact on data confidentiality, integrity, and availability justifies urgent patching.

Risk score, explained

The CVSS v3.1 score of 7.3 (HIGH) reflects a network-accessible vulnerability with low attack complexity and no privilege or user interaction requirements. The scoring acknowledges partial impacts to confidentiality, integrity, and availability—attackers can read files, modify content, or disrupt service depending on exploitation method and server configuration. While not critical, the practical exploitability and real-world consequences of file inclusion attacks place this in the high-priority category for most organizations.

Frequently asked questions