CVE-2026-102263

mwasikz robo-cafe-rms manage-food.php unrestricted upload

View on CVE.org
Published Sep 29, 2026 CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Description
A vulnerability has been found in mwasikz robo-cafe-rms up to 228c44a02823f04e85db32b7137809a2856148fc. The affected element is an unknown function of the file manage-food.php. Such manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The vendor was contacted early about this disclosure but did not respond in any way.

Analysis

AI-generated

Technical impact

The vulnerability resides in an unidentified function within the manage-food.php file of mwasikz robo-cafe-rms and permits administrators to upload arbitrary files without any validation. This flaw can be exploited remotely, allowing an attacker to place executable payloads—such as web shells—on the server where they may be accessed and executed, resulting in full compromise of the web application.

Affected Systems

All releases of mwasikz robo-cafe-rms built before the commit 228c44a02823f04e85db32b7137809a2856148fc are affected. The product follows a rolling release model and currently offers no specific patch or version that resolves the issue.

Risk and Exploitability

The CVSS score of 5.1 indicates a moderate severity, but the lack of file restriction coupled with a publicly disclosed exploit means the risk to any exposed instance is significant. EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is remote and requires only the ability to hit the upload endpoint, making it readily exploitable by attackers with internet access to the target.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Disable the upload function altogether until a vendor fix is released.
  • Implement strict MIME type and file extension checks to allow only approved image formats.
  • Restrict access to the upload endpoint to trusted IPs or internal networks and monitor for suspicious activity.

Generated by OpenCVE AI on September 29, 2026 at 05:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A vulnerability has been found in mwasikz robo-cafe-rms up to 228c44a02823f04e85db32b7137809a2856148fc. The affected element is an unknown function of the file manage-food.php. Such manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The vendor was contacted early about this disclosure but did not respond in any way.
Title mwasikz robo-cafe-rms manage-food.php unrestricted upload
First Time appeared Mwasikz
Mwasikz robo-cafe-rms
Weaknesses CWE-284
CWE-434
CPEs cpe:2.3:a:mwasikz:robo-cafe-rms:*:*:*:*:*:*:*:*
Vendors & Products Mwasikz
Mwasikz robo-cafe-rms
References
Metrics cvssV2_0

{'score': 5.8, 'vector': 'AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 4.7, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 4.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-284

    Improper Access Control

  • CWE-434

    Unrestricted Upload of File with Dangerous Type

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Sep 29, 2026, 4:49 PM
Reserved
Sep 28, 2026, 8:10 PM

View source JSON

Updated
Sep 29, 2026, 4:49 PM

JSON

Status
Deferred
Published
Sep 29, 2026, 5:16 AM
Modified
Sep 29, 2026, 6:57 PM

View source JSON

No data.

Updated
Sep 29, 2026, 1:19 PM

JSON