A path traversal flaw in the /content/images/add endpoint of Shopizer allows attackers to craft a POST request that writes arbitrary files to any writable location on the server. This flaw bypasses normal file‑upload restrictions, enabling attackers to overwrite critical files, place malicious scripts, or otherwise compromise the system’s integrity and potentially its confidentiality. The weakness is a classic path traversal issue, which may let an attacker place files in unintended directories, exposing sensitive data or facilitating further exploitation.

The affected product is Shopizer, an open‑source e‑commerce platform. The vulnerability exists in version 3.2.5.

Because the flaw permits writing to arbitrary paths, its impact is severe; attackers could potentially install web shells or modify application files to execute code or exfiltrate data. The CVSS score of 10 underscores this critical severity. The likely attack vector is a crafted HTTP POST request to the exposed endpoint, and the feasibility hinges on write permissions granted to the application. While the EPSS score is not available, the nature of the vulnerability suggests a high exploitation probability once attackers discover the endpoint. The vulnerability is not listed in the CISA KEV catalog, but its impact warrants immediate remediation.