Unauthenticated Path Traversal in EasyImages2.0 by icret

CVE-2026-117566

What is CVE-2026-117566?

EasyImages2.0 versions 2.0 through 2.8.6 is susceptible to an unauthenticated path traversal vulnerability affecting the app/down.php, app/thumb.php, and app/info.php files. This flaw allows attackers to exploit the dw, history, or img parameters to navigate outside the designated upload directory using '../' sequences. By doing so, they can access and read files with permitted upload extensions from the server, posing a significant risk to data security.

References