The application’s delete.php contains a function that processes a filename argument without proper validation, allowing an attacker to construct paths that traverse out of the intended directory. This path traversal flaw permits remote actors to access or modify files outside the gallery’s scope, potentially exposing sensitive data or compromising the system. The weakness is identified as CWE‑22 and results in a confidentiality breach if files are read or an integrity violation if files are altered or removed.

SourceCodester Modern Image Gallery App version 1.0, released by SourceCodester and distributed under the name Remy Andrade’s Modern Image Gallery App. The vulnerability resides specifically in the delete.php component of this product.

The CVSS score of 6.9 indicates a moderate severity, while the EPSS of less than 1% suggests a low probability of exploitation at the time of this analysis. The flaw is not listed in the CISA KEV catalog. The attack vector is remote, as the vulnerability is triggered by a crafted HTTP request to delete.php with a manipulated filename parameter, implying that any user with network access to the web interface could launch the exploit if no additional controls are in place.