CVE-2026-8802

MEDIUM

opensourcepos Open Source Point of Sale Items.php getPicThumb path traversal

Title source: cna
STIX 2.1

Description

A vulnerability was detected in opensourcepos Open Source Point of Sale up to 3.4.2. This issue affects the function getPicThumb of the file app/Controllers/Items.php. The manipulation of the argument pic_filename results in path traversal. The attack may be launched remotely. The patch is identified as def0c27a0e252668df8d942fc31e16d1edfd7323. A patch should be applied to remediate this issue. The vendor was contacted early about this disclosure.

References (6)

Core 6
Core References
Vdb Entry, Technical Description vdb-entry technical-description
VDB-364435 | opensourcepos Open Source Point of Sale Items.php getPicThumb path traversal
https://vuldb.com/vuln/364435
Signature, Permissions Required signature permissions-required
VDB-364435 | CTI Indicators (IOB, IOC, TTP, IOA)
https://vuldb.com/vuln/364435/cti
Third Party Advisory third-party-advisory
Submit #802559 | opensourcepos Open Source Point of Sale 3.4.1 Path Traversal
https://vuldb.com/submit/802559

Scores

CVSS v3 4.3
EPSS 0.0039
EPSS Percentile 30.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-22
Status published
Products (3)
opensourcepos/Open Source Point of Sale 3.4.0
opensourcepos/Open Source Point of Sale 3.4.1
opensourcepos/Open Source Point of Sale 3.4.2
Published May 18, 2026
Tracked Since May 18, 2026