Path Traversal Vulnerability in Yushine InnoShop Files Endpoint
CVE-2026-18959

5.3MEDIUM

Key Information:

Vendor

Yushine

Status
Innoshop
Vendor
CVE Published:
5 August 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-18959?

A security vulnerability has been identified in Yushine InnoShop, specifically within the FileManagerController::destroyFiles function found in the panel-api.php file. This issue is categorized as a path traversal vulnerability, allowing unauthorized access to files on the server through crafted requests. The vulnerability can be exploited remotely, enabling attackers to manipulate the file destruction process, potentially leading to unauthorized file deletion. Alerts were sent to the vendor regarding this flaw, but no response was recorded, raising concerns about the security measures in place.

Affected Version(s)

InnoShop 0.8.0

InnoShop 0.8.1

InnoShop 0.8.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-18959 - Proof of Concept

References

https://vuldb.com/vuln/386234
vdb-entrytechnical-description
https://vuldb.com/vuln/386234/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-18959
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

HackTen (VulDB User)
VulDB CNA Team
.