The vulnerability resides in an unidentified function within the manage-food.php file of mwasikz robo-cafe-rms and permits administrators to upload arbitrary files without any validation. This flaw can be exploited remotely, allowing an attacker to place executable payloads—such as web shells—on the server where they may be accessed and executed, resulting in full compromise of the web application.

All releases of mwasikz robo-cafe-rms built before the commit 228c44a02823f04e85db32b7137809a2856148fc are affected. The product follows a rolling release model and currently offers no specific patch or version that resolves the issue.

The CVSS score of 5.1 indicates a moderate severity, but the lack of file restriction coupled with a publicly disclosed exploit means the risk to any exposed instance is significant. EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is remote and requires only the ability to hit the upload endpoint, making it readily exploitable by attackers with internet access to the target.