PatchSiren cyber security CVE debrief
CVE-2026-9445 SourceCodester CVE debrief
A vulnerability in SourceCodester Simple POS and Inventory System 1.0 allows authenticated remote attackers to upload files with unrestricted extensions via the image parameter in /admin/addproduct.php. The flaw stems from improper validation of file extensions in the File Extension Handler component, classified under CWE-434 (Unrestricted Upload of File with Dangerous Type) and CWE-284 (Improper Access Control). The CVSS 4.0 vector indicates network attack vector with low attack complexity, requiring low privileges but no user interaction, with low impacts to confidentiality, integrity, and availability. The exploit has been publicly disclosed. The CVE was published on 2026-05-25 and modified on 2026-05-26.
- Vendor
- SourceCodester
- Product
- Simple POS and Inventory System
- CVSS
- LOW 2.1
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-05-25
- Original CVE updated
- 2026-05-26
- Advisory published
- 2026-05-25
- Advisory updated
- 2026-05-26
Who should care
Organizations operating SourceCodester Simple POS and Inventory System 1.0; security teams managing PHP-based point-of-sale applications; administrators responsible for file upload security controls.
Technical summary
The vulnerability exists in the File Extension Handler of /admin/addproduct.php where the image parameter accepts file uploads without proper extension validation. An authenticated attacker with low privileges can upload files with executable extensions, potentially leading to remote code execution depending on server configuration. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/E:P) indicates network accessibility, low complexity, and public exploit availability with low impact ratings across security dimensions.
Defensive priority
LOW
Recommended defensive actions
- Review and implement strict server-side file extension validation and MIME type checking for all upload endpoints, particularly /admin/addproduct.php
- Apply principle of least privilege to administrative interfaces; consider multi-factor authentication for admin access
- Deploy web application firewall rules to detect and block suspicious file upload patterns
- Monitor for unauthorized file uploads in web-accessible directories, especially PHP and executable file types
- Remove or restrict write permissions to directories where uploaded files are stored; prevent direct execution of uploaded content
- Review source code for similar upload validation weaknesses in related components
- If vendor patch becomes available, prioritize testing and deployment in non-production environments first
Evidence notes
Vulnerability identified in /admin/addproduct.php image parameter. CVSS 4.0 score of 2.1 reflects limited impact scope. Vendor attribution to SourceCodester based on reference domain analysis with low confidence; product name not confirmed in source data.
Official resources
Public disclosure occurred on 2026-05-25 with exploit availability confirmed.