CVE-2026-9506
Path Traversal Vulnerability in Bagisto
- State
- Published
- Severity
- 8.7 High
- Published
- Jun 8, 2026
- Updated
- Jun 8, 2026
- Reserved
- May 25, 2026
Description
This vulnerability exists in Bagisto due to improper validation of user-supplied input in the ImageCacheController component. An unauthenticated remote attacker could exploit this vulnerability by sending crafted path traversal sequences through the filename parameter to access arbitrary files outside the intended directory on the targeted system.
Successful exploitation of this vulnerability could allow an attacker to read arbitrary sensitive files on the targeted system.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N | CERT-In |
Weaknesses
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected Products
| Product | Versions |
|---|---|
BagistoWebkul |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.