Description
A vulnerability was detected in yaojingang GEOFlow up to 2.1.0. This vulnerability affects the function unlink of the file app/Http/Controllers/Admin/ImageLibraryController.php of the component Image Library Cleanup. The manipulation of the argument file_path results in path traversal. The attack may be performed from remote. The exploit is now public and may be used. Upgrading to version 2.1.1 is able to resolve this issue. The patch is identified as 67abfd864a15d169a78429f3290c91cb3b93e849. It is recommended to upgrade the affected component.
Published: 2026-08-31
Score: 5.1 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The flaw exists in the unlink operation of GEOFlow’s Image Library Cleanup component. By manipulating the file_path parameter, a remote attacker can traverse the file system and delete any file accessible to the web server. The vulnerability is a classic path traversal (CWE‑22) that results in file deletion, compromising data integrity and potentially disrupting application availability.

Affected Systems

yaojingang GEOFlow releases up to version 2.1.0 are affected. The security patch is included in GEOFlow 2.1.1, committed as 67abfd864a15d169a78429f3290c91cb3b93e849.

Risk and Exploitability

The CVSS score of 5.1 indicates medium severity. An EPSS score is not available and the issue is not listed in the CISA KEV catalog, yet the exploit is publicly disclosed and can be executed remotely. Because the attacker can delete arbitrary files, the risk of data loss and service disruption is tangible if the flaw is left unpatched.

Generated by OpenCVE AI on August 31, 2026 at 09:20 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade GEOFlow to version 2.1.1 or later to apply the official fix, commit 67abfd864a15d169a78429f3290c91cb3b93e849.
  • Implement server‑side validation that normalizes requested file paths, rejects any path containing directory‑traversal components, and restricts deletions to the intended image library directory.
  • Reduce the file system permissions for the image library folder so the application process can only delete files it must manage, limiting the impact of any remaining traversal attempts.

Generated by OpenCVE AI on August 31, 2026 at 09:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 31 Aug 2026 08:30:00 +0000

Type Values Removed Values Added
Description A vulnerability was detected in yaojingang GEOFlow up to 2.1.0. This vulnerability affects the function unlink of the file app/Http/Controllers/Admin/ImageLibraryController.php of the component Image Library Cleanup. The manipulation of the argument file_path results in path traversal. The attack may be performed from remote. The exploit is now public and may be used. Upgrading to version 2.1.1 is able to resolve this issue. The patch is identified as 67abfd864a15d169a78429f3290c91cb3b93e849. It is recommended to upgrade the affected component.
Title yaojingang GEOFlow Image Library Cleanup ImageLibraryController.php unlink path traversal
First Time appeared Yaojingang
Yaojingang geoflow
Weaknesses CWE-22
CPEs cpe:2.3:a:yaojingang:geoflow:*:*:*:*:*:*:*:*
Vendors & Products Yaojingang
Yaojingang geoflow
References
Metrics cvssV2_0

{'score': 4.7, 'vector': 'AV:N/AC:L/Au:M/C:N/I:P/A:P/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 3.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 3.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Yaojingang Geoflow
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-31T08:15:12.012Z

Reserved: 2026-08-30T14:44:01.527Z

Link: CVE-2026-82665

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-31T09:17:04.520

Modified: 2026-08-31T09:17:04.520

Link: CVE-2026-82665

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-31T09:30:04Z

Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')