A vulnerability classified as critical was found in opensourcepos Open Source Point of Sale up to 3.4.2. This issue affects the function
getPicThumb of the file app/Controllers/Items.php. The manipulation of the argument pic_filename results in path traversal.
This vulnerability is cataloged as CVE-2026-8802. The attack may be launched remotely. There is no exploit available.
A patch should be applied to remediate this issue.
The vendor was contacted early about this disclosure.
