CVE-2026-117566
CVE-2026-117566 · EasyImages2.0 through 2.8.6 Unauthenticated Path Traversal via down.php, thumb.php and info.php
Diese Seite enthält Fakten aus öffentlichen Sicherheitsquellen. Lesen Sie vor dem Aktualisieren die Originalmeldung.
EasyImages2.0 through 2.8.6 contains an unauthenticated path traversal vulnerability in app/down.php, app/thumb.php and app/info.php that allows reading files outside the upload directory. Attackers can supply ../ sequences in the dw, history or img parameters to read files with allowed upload extensions from the server.
CVSS 6.9 · Mittel · EPSS 0,4%
- Veröffentlicht
- Aktualisiert
Betroffene Produkte und Versionen
easyimages2.0
- Softwareversionen
- ≥ 0, ≤ 2.8.6: Betroffen (semver)
Keine Korrektur veröffentlicht
Originalquellen
- https://github.com/icret/EasyImages2.0/issues/286
- https://github.com/icret/EasyImages2.0
- https://github.com/icret/EasyImages2.0/commit/e337a2bee7e7c67eb90bc4364a345c0857cb73aa
- https://github.com/icret/EasyImages2.0/blob/2.8.6/app/down.php#L17-L49
- https://www.vulncheck.com/advisories/easyimages2-0-through-2.8.6-unauthenticated-path-traversal-via-down-php-thumb-php-and-info-php
- https://nvd.nist.gov/vuln/detail/CVE-2026-117566