CVE-2026-8802

A vulnerability was detected in opensourcepos Open Source Point of Sale up to 3.4.2. This issue affects the function getPicThumb of the file app/Controllers/Items.php. The manipulation of the argument pic_filename results in path traversal. The attack may be launched remotely. The patch is identified as def0c27a0e252668df8d942fc31e16d1edfd7323. A patch should be applied to remediate this issue. The vendor was contacted early about this disclosure.

• CWE-22

• https://github.com/opensourcepos/opensourcepos/commit/def0c27a0e252668df8d942fc31e16d1edfd7323
• https://github.com/opensourcepos/opensourcepos/pull/4545
• https://github.com/opensourcepos/opensourcepos/security/advisories/GHSA-xq63-3v4g-39r5
• https://vuldb.com/submit/802559
• https://vuldb.com/vuln/364435
• https://vuldb.com/vuln/364435/cti

Published

May 18, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-88013rclone is a command-line program to sync files and directori…5.3
• CVE-2026-88014rclone is a command-line program to sync files and directori…6.3
• CVE-2026-88015rclone is a command-line program to sync files and directori…5.3
• CVE-2026-88016rclone is a command-line program to sync files and directori…7.1
• CVE-2026-88017rclone is a command-line program to sync files and directori…7.3
• CVE-2026-88018rclone is a command-line program to sync files and directori…9.8
• CVE-2026-88020Autonomy Logic OpenPLC 3 is susceptible to an improper neutr…6.1
• CVE-2026-88021Consul and Consul Enterprise are vulnerable to an authorizat…7.1
• CVE-2026-88022Improper neutralization of special elements in data query lo…7.7
• CVE-2026-88023Improper neutralization of special elements in data query lo…8.3
• CVE-2026-88024Improper neutralization of special elements in data query lo…8.3
• CVE-2026-88025Improper neutralization of special elements in data query lo…8.3