CVE-2026-8802opensourcepos Open Source Point of Sale Items.php getPicThumb path traversal
Updated under an hour ago ()
Does this affect you?
It affects opensourcepos Open Source Point of Sale. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
A vulnerability was detected in opensourcepos Open Source Point of Sale up to 3.4.2. This issue affects the function getPicThumb of the file app/Controllers/Items.php. The manipulation of the argument pic_filename results in path traversal. The attack may be launched remotely. The patch is identified as def0c27a0e252668df8d942fc31e16d1edfd7323. A patch should be applied to remediate this issue. The vendor was contacted early about this disclosure.
- CVSS
- 4.3 MEDIUM (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C
- Weakness (CWE)
- CWE-22
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- VulDB
- NVD analysis
- Deferred
- Record last updated
- May 18, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
opensourcepos Open Source Point of Sale opensourcepos:open_source_point_of_sale | 3.4.0; 3.4.1; 3.4.2 | CNA record |
References
- https://vuldb.com/vuln/364435vdb-entry, technical-description
- https://vuldb.com/vuln/364435/ctisignature, permissions-required
- https://vuldb.com/submit/802559third-party-advisory
- https://github.com/opensourcepos/opensourcepos/security/advisories/GHSA-xq63-3v4g-39r5broken-link
- https://github.com/opensourcepos/opensourcepos/pull/4545issue-tracking, patch
- https://github.com/opensourcepos/opensourcepos/commit/def0c27a0e252668df8d942fc31e16d1edfd7323patch
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.