A path traversal vulnerability was found in the Ueditor Upload Interface of ShopXO. By manipulating the path_type argument in the config/ueditor.php file, an attacker can cause the application to resolve file paths outside the intended upload directory. This flaw allows remote attackers to read, modify, or delete files on the server, potentially leading to data disclosure or code execution depending on the files accessed. The vulnerability is exploitable over a network, and the public exploit code is available.

ShopXO versions up to 2.2.7 are affected. The issue resides in the open‑source component Ueditor used by the ShopXO e‑commerce platform. Admins in these installations are at risk if the upload interface is exposed.

The CVSS v3.1 score of 6.9 indicates a high‑to‑medium severity. Although no EPSS score is available, the fact that the exploit is publicly available suggests a relatively high likelihood of real‑world attacks. The vulnerability is not listed in CISA’s KEV catalog, but the path traversal flaw is a classic example of CWE‑22. The attack vector is remote over HTTP; any user with access to the Ueditor upload endpoint can trigger the traversal.