CVE-2026-10559 Details

A local file inclusion vulnerability has been identified in SourceCodester Pizzafy Ecommerce System version 1.0. The issue arises in the index.php file, where the application fails to properly validate the 'page' parameter. This flaw allows for null byte injection, bypassing file extension restrictions and enabling the inclusion of arbitrary files. The vulnerability can be exploited remotely, potentially leading to information disclosure or even remote code execution through log poisoning.

To address this vulnerability, implement input validation to restrict the 'page' parameter to predefined values. Normalize paths to ensure they remain within the intended directory, and update the PHP environment to a version that does not allow null byte injection. Avoid using user input directly in file inclusion functions.