CVE-2026-78394mediumCWE-22

CVE-2026-78394: falha de média gravidade em Link Library

Link Library < 7.9.6 - Contributor+ Path Traversal via 'filepath' Parameter

Publicada em

Seguir esta CVE+ Monitorar Link Library

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

33Vexday Risk Score

Sem sinal de exploração. Ela tem prova de conceito pública.

ssvc Attendcvss 4.1epss 0.2%
The Link Library WordPress plugin before 7.9.6 does not sanitize a user-supplied destination folder before writing a generated image to disk, allowing users with the Contributor role and above to create directories and write or overwrite image files anywhere the web server can write, including outside the site's document root. The written file name is always numeric with a fixed image extension, so executable code cannot be planted this way.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:N
Produtos afetados
Unknown · Link Library
⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — Link Library

No mesmo produto, das mais perigosas para as menos.

CVE-2021-25093—Link Library < 7.2.8 - Unauthenticated Arbitrary Links DeletionEPSS 1.2%CVE-2021-25091—Link Library < 7.2.9 - Reflected Cross-Site ScriptingEPSS 0.8%CVE-2026-16535MEDIUMLink Library < 7.9.4 - Reflected XSS via Thumbs-Rating likelabelEPSS 0.5%CVE-2021-25092—Link Library < 7.2.8 - Library Settings Reset via CSRFEPSS 0.5%CVE-2022-4199MEDIUMLink Library < 7.4.1 - Admin+ Stored XSSEPSS 0.5%CVE-2026-16532CRITICALLink Library < 7.9.3 - Unauthenticated SQL Injection via the Front-End Link Submission FormEPSS 0.5%