Path Traversal Vulnerability in Infinite Image Browsing by Zanllp

CVE-2026-77814

What is CVE-2026-77814?

A path traversal vulnerability exists in the Infinite Image Browsing application where the 'is_path_trusted' function inadequately checks requested file paths against allowed directories. This flaw occurs because the path comparison does not append a path separator, allowing unauthorized access to files outside the intended directory. Specifically, a request for files such as '/data/images_private/secret.txt' can be mistakenly treated as trusted if '/data/images' is an allowed parent directory. The vulnerability is contingent on access control settings, with the risk heightened in network-exposed deployments. The appropriate remedy involves enhancing the check to use a proper path separator.

References