CVE-2026-9506highCWE-22

CVE-2026-9506: fallo de gravedad alta en Webkul Bagisto

Path Traversal Vulnerability in Bagisto

Publicada el

Seguir esta CVE+ Monitorear Bagisto

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

36Vexday Risk Score

Corrige pronto. Ella tiene exploit funcional público.

ssvc Attendcvss 8.7epss 1.4%
This vulnerability exists in Bagisto due to improper validation of user-supplied input in the ImageCacheController component. An unauthenticated remote attacker could exploit this vulnerability by sending crafted path traversal sequences through the filename parameter to access arbitrary files outside the intended directory on the targeted system. Successful exploitation of this vulnerability could allow an attacker to read arbitrary sensitive files on the targeted system.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Productos afectados
Webkul · Bagisto
CVEs relacionadas — Webkul Bagisto

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-19835MEDIUMWebkul Bagisto Customer Item Deletion Endpoint access controlEPSS 0.5%CVE-2026-75082MEDIUMWebkul Bagisto Customer-Registration Notification Email register cross site scriptingEPSS 0.4%CVE-2026-19997MEDIUMWebkul Bagisto Backend Sales RMA Endpoint requests authorizationEPSS 0.4%CVE-2026-19834MEDIUMWebkul Bagisto Admin Customer Impersonation Feature login-as-customer authorizationEPSS 0.4%CVE-2026-19837MEDIUMWebkul Bagisto Customer Search search information disclosureEPSS 0.4%CVE-2026-19838MEDIUMWebkul Bagisto Backend Reporting Endpoint sales authorizationEPSS 0.4%