CVE-2026-78394mediumCWE-22

CVE-2026-78394: medium-severity vulnerability in Link Library

Link Library < 7.9.6 - Contributor+ Path Traversal via 'filepath' Parameter

Published

Follow this CVE+ Monitor Link Library

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 4.1epss 0.2%
The Link Library WordPress plugin before 7.9.6 does not sanitize a user-supplied destination folder before writing a generated image to disk, allowing users with the Contributor role and above to create directories and write or overwrite image files anywhere the web server can write, including outside the site's document root. The written file name is always numeric with a fixed image extension, so executable code cannot be planted this way.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:N
Affected products
Unknown · Link Library
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Link Library

In the same product, most dangerous first.

CVE-2021-25093—Link Library < 7.2.8 - Unauthenticated Arbitrary Links DeletionEPSS 1.2%CVE-2021-25091—Link Library < 7.2.9 - Reflected Cross-Site ScriptingEPSS 0.8%CVE-2026-16535MEDIUMLink Library < 7.9.4 - Reflected XSS via Thumbs-Rating likelabelEPSS 0.5%CVE-2021-25092—Link Library < 7.2.8 - Library Settings Reset via CSRFEPSS 0.5%CVE-2022-4199MEDIUMLink Library < 7.4.1 - Admin+ Stored XSSEPSS 0.5%CVE-2026-16532CRITICALLink Library < 7.9.3 - Unauthenticated SQL Injection via the Front-End Link Submission FormEPSS 0.5%