Path Traversal Vulnerability in INDOTALENT WHMS by Go2Ismail

CVE-2026-125385

What is CVE-2026-125385?

INDOTALENT WHMS prior to version 10.20261109 is susceptible to a path traversal vulnerability that enables authenticated users to read sensitive files by manipulating the documentName and imageName parameters. Attackers can exploit this flaw by self-registering and injecting traversal sequences into the GetDocument or GetImage functions, which fail to implement proper containment checks. This weakness could potentially allow unauthorized access to critical configuration files, such as appsettings.json, posing a severe risk to data integrity and security.

References