CVE-2026-117566
CVE-2026-117566 · EasyImages2.0 through 2.8.6 Unauthenticated Path Traversal via down.php, thumb.php and info.php
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
EasyImages2.0 through 2.8.6 contains an unauthenticated path traversal vulnerability in app/down.php, app/thumb.php and app/info.php that allows reading files outside the upload directory. Attackers can supply ../ sequences in the dw, history or img parameters to read files with allowed upload extensions from the server.
CVSS 6.9 · Media · EPSS 0,4%
- Publicación
- Actualización
Productos y versiones afectados
easyimages2.0
- Versiones
- ≥ 0, ≤ 2.8.6: Afectada (semver)
Sin corrección publicada
Fuentes originales
- https://github.com/icret/EasyImages2.0/issues/286
- https://github.com/icret/EasyImages2.0
- https://github.com/icret/EasyImages2.0/commit/e337a2bee7e7c67eb90bc4364a345c0857cb73aa
- https://github.com/icret/EasyImages2.0/blob/2.8.6/app/down.php#L17-L49
- https://www.vulncheck.com/advisories/easyimages2-0-through-2.8.6-unauthenticated-path-traversal-via-down-php-thumb-php-and-info-php
- https://nvd.nist.gov/vuln/detail/CVE-2026-117566