CVE-2026-8802

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

A vulnerability was detected in opensourcepos Open Source Point of Sale up to 3.4.2. This issue affects the function getPicThumb of the file app/Controllers/Items.php. The manipulation of the argument pic_filename results in path traversal. The attack may be launched remotely. The patch is identified as def0c27a0e252668df8d942fc31e16d1edfd7323. A patch should be applied to remediate this issue. The vendor was contacted early about this disclosure.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published
May 18, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-880206.1Autonomy Logic OpenPLC 3 is susceptible to an improper neutralization of input during web page generation vulnerability when the web interfaCVE-2026-880217.1Consul and Consul Enterprise are vulnerable to an authorization bypass in the Connect service mesh that may allow a service to reach a destiCVE-2026-880227.7Improper neutralization of special elements in data query logic in the MongoDB integration for Laravel can cause an array supplied to an expCVE-2026-880238.3Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB PHP Library can cause a caller-suppliCVE-2026-880248.3Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Rust Driver can cause a caller-suppliCVE-2026-880258.3Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C# Driver can cause a caller-suppliedCVE-2026-880266.5Improper neutralization of regular-expression metacharacters in the LINQ query translation component of the MongoDB C# Driver can cause a caCVE-2026-880278.1Improper neutralization of special elements in data query logic in the embedded-document relation handling of the MongoDB integration for LaCVE-2026-880286.5Improper neutralization of special elements in data query logic in the polymorphic relation handling of the MongoDB integration for Laravel CVE-2026-880298.3Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Python Driver can cause a caller-suppCVE-2026-88033.7A flaw has been found in opensourcepos Open Source Point of Sale up to 3.4.2. Impacted is the function Login of the file app/Models/EmployeeCVE-2026-880308.3Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Ruby Driver can cause a caller-suppli
CVE-2026-8802: Medium severity, CVSS 4.3 | Vulnix