A path traversal vulnerability exists in the unlink operation of the admin/delete.php script in SourceCodester Online Food Ordering System 1.0. The flaw allows an attacker to manipulate the image_name parameter and delete arbitrary files on the server. This can lead to loss of data, denial of service, or compromise of critical system files.

SourceCodester Online Food Ordering System version 1.0 is affected. The vulnerability resides in the admin/delete.php component and is tied to the deletion functionality exposed by the image_name argument.

The CVSS score of 6.9 reflects a moderate severity, but the remote nature of the attack vector and the public availability of an exploit increase its practical risk. With no EPSS data and the vulnerability not listed in CISA KEV, the likelihood of exploitation remains uncertain; however, the publicly disclosed exploit suggests that skilled adversaries can successfully delete files from affected installations.