A vulnerability classified as critical was found in opensourcepos Open Source Point of Sale up to 3.4.2 . This issue affects the function getPicThumb of the file app/Controllers/Items.php . The manipulation of the argument pic_filename results in path traversal. This vulnerability is cataloged as CVE-2026-8802 . The attack may be launched remotely. There is no exploit available. A patch should be applied to remediate this issue. The vendor was contacted early about this disclosure.