CVE-2026-117566
CVE-2026-117566 · EasyImages2.0 through 2.8.6 Unauthenticated Path Traversal via down.php, thumb.php and info.php
This page contains facts from public vulnerability sources. Check the original advisory before updating.
EasyImages2.0 through 2.8.6 contains an unauthenticated path traversal vulnerability in app/down.php, app/thumb.php and app/info.php that allows reading files outside the upload directory. Attackers can supply ../ sequences in the dw, history or img parameters to read files with allowed upload extensions from the server.
CVSS 6.9 · Medium · EPSS 0.4%
- Published
- Updated
Affected products and versions
easyimages2.0
- Versions
- ≥ 0, ≤ 2.8.6: Affected (semver)
No fix published
Original sources
- https://github.com/icret/EasyImages2.0/issues/286
- https://github.com/icret/EasyImages2.0
- https://github.com/icret/EasyImages2.0/commit/e337a2bee7e7c67eb90bc4364a345c0857cb73aa
- https://github.com/icret/EasyImages2.0/blob/2.8.6/app/down.php#L17-L49
- https://www.vulncheck.com/advisories/easyimages2-0-through-2.8.6-unauthenticated-path-traversal-via-down-php-thumb-php-and-info-php
- https://nvd.nist.gov/vuln/detail/CVE-2026-117566