Description
EasyImages2.0 through 2.8.6 contains an unauthenticated path traversal vulnerability in app/down.php, app/thumb.php and app/info.php that allows reading files outside the upload directory. Attackers can supply ../ sequences in the dw, history or img parameters to read files with allowed upload extensions from the server.
Published: 2026-10-27
Score: 6.9 Medium
EPSS: n/a
KEV: No
Impact: Information Disclosure
Action: Apply Patch
AI Analysis

Impact

The vulnerability allows an unauthenticated attacker to supply path traversal sequences ("../") in the dw, history or img parameters of app/down.php, app/thumb.php, and app/info.php. This enables the attacker to read any file on the server that matches allowed upload extensions, effectively exposing configuration files, logs, or other sensitive data. The flaw is a classic path traversal weakness with a CVE-identified CWE-22.

Affected Systems

The affected product is icret:EasyImages2.0, versions ranging from 2.0 through 2.8.6. These are web‑based image management applications that were released on GitHub under the EasyImages2.0 project.

Risk and Exploitability

The CVSS score of 6.9 indicates a moderate severity, and EPSS score is not available for this entry. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit this flaw remotely over HTTP without authentication, making it potentially accessible to anyone with network access to the hosting environment. Because the flaw permits arbitrary file reads, the risk to confidentiality is significant, though it does not lead to remote code execution or denial of service.

Generated by OpenCVE AI on October 27, 2026 at 14:50 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the most recent release of EasyImages2.0 (2.8.7 or later) that contains the path traversal fix, if available from the project repository or vendor channel.
  • Re‑configure the web server to serve only the designated upload directory and disable directory indexing or other directory traversal paths. This limits the ability of the application to serve files outside the intended folder.
  • Add strict input validation on the dw, history, and img parameters to accept only expected filenames without any dot‑dot or slash characters, and enforce whitelisting of allowed file extensions.

Generated by OpenCVE AI on October 27, 2026 at 14:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 27 Oct 2026 13:45:00 +0000

Type Values Removed Values Added
Description EasyImages2.0 through 2.8.6 contains an unauthenticated path traversal vulnerability in app/down.php, app/thumb.php and app/info.php that allows reading files outside the upload directory. Attackers can supply ../ sequences in the dw, history or img parameters to read files with allowed upload extensions from the server.
Title EasyImages2.0 through 2.8.6 Unauthenticated Path Traversal via down.php, thumb.php and info.php
First Time appeared Easyimages2.0 Project
Easyimages2.0 Project easyimages2.0
Weaknesses CWE-22
CPEs cpe:2.3:a:easyimages2.0_project:easyimages2.0:*:*:*:*:*:*:*:*
Vendors & Products Easyimages2.0 Project
Easyimages2.0 Project easyimages2.0
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Easyimages2.0 Project Easyimages2.0
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-27T13:07:59.767Z

Reserved: 2026-10-27T11:25:25.190Z

Link: CVE-2026-117566

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-27T14:16:39.017

Modified: 2026-10-27T14:16:39.017

Link: CVE-2026-117566

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-27T15:00:05Z

Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')