CVE-2026-10559: Pizzafy Ecommerce Path Traversal Flaw

CVE-2026-10559 Overview

CVE-2026-10559 is a Local File Inclusion (LFI) vulnerability in SourceCodester Pizzafy Ecommerce System 1.0. The flaw resides in an unspecified function within /index.php, where manipulation of the page parameter allows attackers to include arbitrary files from the underlying server. According to the public writeup, the issue can be triggered via null byte injection. The vulnerability is exploitable remotely and requires low privileges. A public exploit has been disclosed, increasing exposure for unpatched deployments [CWE-73].

Critical Impact
Authenticated remote attackers can read sensitive files or execute included content by manipulating the page parameter of /index.php in SourceCodester Pizzafy Ecommerce System 1.0.

Affected Products

SourceCodester Pizzafy Ecommerce System 1.0
The /index.php script handling the page query parameter
Deployments exposing the application to untrusted networks

Discovery Timeline

2026-06-02 - CVE-2026-10559 published to NVD
2026-06-02 - Last updated in NVD database

Technical Details for CVE-2026-10559

Vulnerability Analysis

The vulnerability is classified as External Control of File Name or Path [CWE-73]. The /index.php script accepts a page parameter and uses its value to construct a file path that is subsequently included or read by the application. Because input is not validated against an allowlist of permitted templates, attackers can supply arbitrary path values. According to the published GitHub CVE Writeup, null byte injection is used to truncate appended suffixes such as .php, allowing inclusion of files with arbitrary extensions. The attack succeeds remotely with low-privileged access and no user interaction.

Root Cause

The root cause is unsafe handling of user-controlled input passed to a file inclusion sink. The application directly concatenates the page parameter into a file path without sanitization, canonicalization, or comparison against an allowlist. Null byte handling in the underlying string processing further enables suffix truncation, broadening the set of files an attacker can target.

Attack Vector

An attacker sends a crafted HTTP request to /index.php with the page parameter set to a traversal sequence or absolute path, optionally terminated by a null byte (%00). The server resolves the path and includes the target file. Successful exploitation can expose configuration files, credentials, and source code. If user-controlled content can be written to a known location on the server, the same primitive may be escalated to code execution. Additional technical context is available in the VulDB entry for CVE-2026-10559.

Detection Methods for CVE-2026-10559

Indicators of Compromise

Requests to /index.php containing page= values with ../ traversal sequences or absolute paths such as /etc/passwd.
URL-encoded null bytes (%00) appended to the page parameter.
Web server access logs showing unexpected file reads correlated with index.php requests.
Anomalous outbound responses containing contents of sensitive configuration files.

Detection Strategies

Inspect HTTP query strings on /index.php for path traversal patterns, null bytes, and file extensions outside the expected template set.
Compare requested page values against the application's known set of legitimate views and alert on deviations.
Correlate web access logs with file-read telemetry from the host to identify successful inclusions of sensitive files.

Monitoring Recommendations

Enable verbose access logging on the web server hosting Pizzafy Ecommerce System and forward logs to a central analytics pipeline.
Add web application firewall (WAF) rules targeting LFI signatures on the page parameter and alert on matches.
Monitor for unauthorized reads of sensitive files such as /etc/passwd, wp-config.php, or application database configuration files originating from the web server process.

How to Mitigate CVE-2026-10559

Immediate Actions Required

Restrict network access to the Pizzafy Ecommerce System 1.0 application until a fix is applied.
Deploy a WAF rule blocking traversal sequences (../), absolute paths, and null bytes in the page parameter of /index.php.
Audit web server logs for prior exploitation attempts referencing the indicators above.
Rotate any credentials, API keys, or secrets stored in files reachable from the application directory.

Patch Information

No vendor patch has been referenced in the NVD entry at the time of publication. Refer to the SourceCodester project page for updated releases and to the VulDB Vulnerability #367649 record for further remediation tracking.

Workarounds

Modify /index.php to validate the page parameter against a hardcoded allowlist of permitted view names before any include operation.
Strip null bytes and reject input containing /, \, or .. sequences prior to file resolution.
Configure PHP with open_basedir restrictions to confine file access to the application directory.
Run the web server process under a least-privileged account with no read access to sensitive system files.

bash

# Configuration example: php.ini hardening to limit file inclusion scope
open_basedir = "/var/www/pizzafy/:/tmp/"
allow_url_include = Off
allow_url_fopen = Off