CVE-2026-113491
CVE-2026-113491 · GeoDirectory < 2.8.194 - Subscriber+ Media File Disclosure and Deletion via Path Traversal
Diese Seite enthält Fakten aus öffentlichen Sicherheitsquellen. Lesen Sie vor dem Aktualisieren die Originalmeldung.
The GeoDirectory WordPress plugin before 2.8.194 does not validate a user-supplied image URL before using it as a local file path when saving a front-end listing, allowing users with Subscriber-level access and above to read files from outside the web root and to delete files on the server, limited to file names that carry an allowed media extension. A disclosed file is re-published at a public URL and its original is deleted as a side effect.
CVSS 6.4 · Mittel · EPSS 0,2% · Korrektur verfügbar
- Veröffentlicht
- Aktualisiert
Betroffene Produkte und Versionen
geodirectory
- Softwareversionen
- ≥ 0, < 2.8.194: Betroffen (semver)
Auf 2.8.194 aktualisieren