Directory Traversal Vulnerability in Innoshop by Innocommerce

CVE-2025-52922

What is CVE-2025-52922?

Innoshop version 0.4.1 is susceptible to directory traversal vulnerabilities through its FileManager API endpoints. An authenticated user with administrative privileges can exploit this vulnerability to gain extensive access to the filesystem. This may lead to unauthorized actions such as mapping the entire filesystem structure, creating arbitrary directories, copying or deleting files, and uploading files to locations outside intended parameters. Such access can have serious implications for the integrity and confidentiality of the server's data.

References