{"id":"CVE-2026-116223","kind":"vulnerability","aliases":["CVE-2026-116223"],"related":[],"title":"EasyImage: flaw in app/del.php lets remote attackers gain improper privileges","description":"A flaw has been found in icret EasyImage up to 2.8.7. The impacted element is an unknown function of the file app/del.php. Executing a manipulation of the argument hash can lead to improper privilege management. The attack can be launched remotely. The exploit has been published and may be used. This patch is called b12cb67d447bcbb67e21c8f011d0f5638229760c. A patch should be applied to remediate this issue.","summary":"EasyImage up to 2.8.7 has a flaw in app/del.php where a manipulated hash argument leads to improper privilege management. The sources say the attack can be launched remotely and that a public exploit has been published.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["easyimage","image-hosting","package","php","self-hosted"],"not_affected_if":["not-running-easyimage"],"how_to_check":"- Check the installed EasyImage version; versions up to and including `2.8.7` are reported affected\n- Look for the patch commit `b12cb67d447bcbb67e21c8f011d0f5638229760c` in the deployed code, or check whether `app/del.php` matches the patched version\n- Review web server access logs for requests to `app/del.php` with unusual `hash` parameter values","fix":"- Update EasyImage to a version newer than `2.8.7` that includes commit `b12cb67d447bcbb67e21c8f011d0f5638229760c`\n- Until patched, restrict access to `app/del.php` at the web server or firewall level\n- unknown whether a fixed release number exists beyond the patch commit","status":"open","published_at":"2026-10-26T07:17:09+00:00","first_seen_at":"2026-10-26T07:28:50+00:00","triaged_at":"2026-10-26T07:29:57+00:00","updated_at":"2026-10-26T07:29:57+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-26T07:29:57Z","model":"claude-haiku-5-5","output":{"fix":"- Update EasyImage to a version newer than `2.8.7` that includes commit `b12cb67d447bcbb67e21c8f011d0f5638229760c`\n- Until patched, restrict access to `app/del.php` at the web server or firewall level\n- unknown whether a fixed release number exists beyond the patch commit","reach":"internet","title":"EasyImage: flaw in app/del.php lets remote attackers gain improper privileges","impact":"medium","summary":"EasyImage up to 2.8.7 has a flaw in app/del.php where a manipulated hash argument leads to improper privilege management. The sources say the attack can be launched remotely and that a public exploit has been published.","category":"package","nicknames":[],"who_cares":["easyimage","php","self-hosted","image-hosting"],"confidence":0.5,"needs_auth":"unknown","worst_case":"attacker gains elevated privileges on the EasyImage instance remotely","analyst_note":"Confirm whether authentication is required and whether a fixed release version exists; check the commit at the source repository and the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-116223.","how_to_check":"- Check the installed EasyImage version; versions up to and including `2.8.7` are reported affected\n- Look for the patch commit `b12cb67d447bcbb67e21c8f011d0f5638229760c` in the deployed code, or check whether `app/del.php` matches the patched version\n- Review web server access logs for requests to `app/del.php` with unusual `hash` parameter values","needs_analyst":true,"not_affected_if":["not-running-easyimage"],"who_is_affected":"Any deployment of icret EasyImage at version 2.8.7 or earlier is potentially exposed, since the flaw is reachable remotely through the del.php endpoint. The sources do not say whether authentication or a non-default setting is required. Teams not running EasyImage can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000686,"input_tokens":3342,"output_tokens":704,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116223':13A,16A '-2026':12A,15A '2.8.7':29B,72C 'app/del.php':4A,34B,83C 'appli':121C 'argument':39B,89C 'attack':7A,49B,98C 'b12cb67d447bcbb67e21c8f011d0f5638229760c':116C 'call':115C 'cve':11A,14A 'easyimag':1A,17B,26B,69C 'element':75C 'execut':84C 'exploit':58B,104C 'file':82C 'flaw':2A,32B,63C 'found':66C 'function':79C 'gain':8A 'hash':38B,90C 'host':20B,25B 'icret':68C 'imag':19B 'image-host':18B 'impact':74C 'improp':9A,42B,94C 'issu':125C 'launch':52B,101C 'lead':40B,92C 'let':5A 'manag':44B,96C 'manipul':37B,86C 'may':109C 'packag':21B 'patch':113C,118C 'php':22B 'privileg':10A,43B,95C 'public':57B 'publish':61B,107C 'remedi':123C 'remot':6A,53B,102C 'say':47B 'self':24B 'self-host':23B 'sourc':46B 'unknown':78C 'use':111C","nicknames":[],"mitigations":[],"who_affected":"Any deployment of icret EasyImage at version 2.8.7 or earlier is potentially exposed, since the flaw is reachable remotely through the del.php endpoint. The sources do not say whether authentication or a non-default setting is required. Teams not running EasyImage can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T07:17:09+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116223","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116223","severity":null,"published_at":"2026-10-26T07:17:09+00:00","modified_at":"2026-10-26T07:17:09+00:00","first_seen_at":"2026-10-26T07:28:50+00:00","fetched_at":"2026-10-26T07:28:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}