Path Traversal Vulnerability in Infinite Image Browsing by Zanllp

CVE-2026-77815

What is CVE-2026-77815?

A vulnerability in Infinite Image Browsing allows for a path traversal attack, exploiting the to_abs_path function in scripts/iib/tool.py. This function utilizes os.path.normpath to normalize requested paths but fails to resolve symbolic links. As a result, a symlink placed within a scanned directory can potentially point outside that directory, leading to file disclosures — including sensitive files such as '/etc/passwd'. The extent of this vulnerability is contingent upon the access control settings specified in the application, with certain configurations potentially exposing all readable files. A patch has been implemented that resolves the path using os.path.realpath to mitigate this issue.

References