CVE-2026-113491
CVE-2026-113491 · GeoDirectory < 2.8.194 - Subscriber+ Media File Disclosure and Deletion via Path Traversal
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
The GeoDirectory WordPress plugin before 2.8.194 does not validate a user-supplied image URL before using it as a local file path when saving a front-end listing, allowing users with Subscriber-level access and above to read files from outside the web root and to delete files on the server, limited to file names that carry an allowed media extension. A disclosed file is re-published at a public URL and its original is deleted as a side effect.
CVSS 6.4 · Media · EPSS 0,2% · Corrección disponible
- Publicación
- Actualización
Productos y versiones afectados
geodirectory
- Versiones
- ≥ 0, < 2.8.194: Afectada (semver)
Actualiza a 2.8.194