CVE-2026-9506highCWE-22

CVE-2026-9506: falha de alta gravidade em Webkul Bagisto

Path Traversal Vulnerability in Bagisto

Publicada em

Seguir esta CVE+ Monitorar Bagisto

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

36Vexday Risk Score

Corrija em breve. Ela tem exploit funcional público.

ssvc Attendcvss 8.7epss 1.4%
This vulnerability exists in Bagisto due to improper validation of user-supplied input in the ImageCacheController component. An unauthenticated remote attacker could exploit this vulnerability by sending crafted path traversal sequences through the filename parameter to access arbitrary files outside the intended directory on the targeted system. Successful exploitation of this vulnerability could allow an attacker to read arbitrary sensitive files on the targeted system.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
Webkul · Bagisto
CVEs relacionadas — Webkul Bagisto

No mesmo produto, das mais perigosas para as menos.

CVE-2026-19835MEDIUMWebkul Bagisto Customer Item Deletion Endpoint access controlEPSS 0.5%CVE-2026-75082MEDIUMWebkul Bagisto Customer-Registration Notification Email register cross site scriptingEPSS 0.4%CVE-2026-19997MEDIUMWebkul Bagisto Backend Sales RMA Endpoint requests authorizationEPSS 0.4%CVE-2026-19834MEDIUMWebkul Bagisto Admin Customer Impersonation Feature login-as-customer authorizationEPSS 0.4%CVE-2026-19837MEDIUMWebkul Bagisto Customer Search search information disclosureEPSS 0.4%CVE-2026-19838MEDIUMWebkul Bagisto Backend Reporting Endpoint sales authorizationEPSS 0.4%