Description
A flaw has been found in yushine InnoShop up to 0.8.2. Affected by this issue is the function FileManagerController::destroyFiles of the file innopacks/restapi/routes/panel-api.php of the component Files Endpoint. This manipulation causes path traversal. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-08-05
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A path traversal flaw exists in the destroyFiles method of yushine InnoShop, enabling an attacker to supply a crafted file path and cause deletion of files on the server. The weakness is an improper path validation flaw, classified as CWE-22, and can be triggered remotely via HTTP requests to the panel-api.php route.

Affected Systems

All yushine InnoShop installations up to version 0.8.2 are affected, particularly the FileManagerController::destroyFiles endpoint located in innopacks/restapi/routes/panel-api.php of the Files Endpoint component.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity, and the presence of a published exploit shows that the vulnerability can be used remotely. The EPSS score is not available, but the risk remains notable. The flaw is not listed in CISA’s KEV catalog. An attacker can exploit the API endpoint from a remote location and delete or manipulate files on the server system.

Generated by OpenCVE AI on August 5, 2026 at 22:24 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor‑issued patch or upgrade to a version of InnoShop newer than 0.8.2 to eliminate the path traversal flaw.
  • Restrict access to the panel‑api.php endpoint, for example by placing it behind a firewall rule or requiring strong authentication for administrators.
  • Add server‑side input validation that ensures requested file paths remain within a designated safe directory and rejects attempts that traverse outside of it.

Generated by OpenCVE AI on August 5, 2026 at 22:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 05 Aug 2026 20:45:00 +0000

Type Values Removed Values Added
Description A flaw has been found in yushine InnoShop up to 0.8.2. Affected by this issue is the function FileManagerController::destroyFiles of the file innopacks/restapi/routes/panel-api.php of the component Files Endpoint. This manipulation causes path traversal. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title yushine InnoShop Files Endpoint panel-api.php destroyFiles path traversal
First Time appeared Yushine
Yushine innoshop
Weaknesses CWE-22
CPEs cpe:2.3:a:yushine:innoshop:*:*:*:*:*:*:*:*
Vendors & Products Yushine
Yushine innoshop
References
Metrics cvssV2_0

{'score': 5.5, 'vector': 'AV:N/AC:L/Au:S/C:N/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 5.4, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Yushine Innoshop
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-05T20:15:10.144Z

Reserved: 2026-08-05T14:05:45.834Z

Link: CVE-2026-18959

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-05T22:30:05Z

Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')