---
id: "CVE-2026-116223"
kind: "vulnerability"
aliases: ["CVE-2026-116223"]
title: "EasyImage: flaw in app/del.php lets remote attackers gain improper privileges"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["easyimage", "image-hosting", "package", "php", "self-hosted"]
not_affected_if: ["not-running-easyimage"]
published_at: "2026-10-26T07:17:09+00:00"
first_seen_at: "2026-10-26T07:28:50+00:00"
updated_at: "2026-10-26T07:29:57+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116223", "first_seen_at": "2026-10-26T07:28:50+00:00"}]
---

# EasyImage: flaw in app/del.php lets remote attackers gain improper privileges

EasyImage up to 2.8.7 has a flaw in app/del.php where a manipulated hash argument leads to improper privilege management. The sources say the attack can be launched remotely and that a public exploit has been published.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed EasyImage version; versions up to and including `2.8.7` are reported affected
- Look for the patch commit `b12cb67d447bcbb67e21c8f011d0f5638229760c` in the deployed code, or check whether `app/del.php` matches the patched version
- Review web server access logs for requests to `app/del.php` with unusual `hash` parameter values

## Fix

- Update EasyImage to a version newer than `2.8.7` that includes commit `b12cb67d447bcbb67e21c8f011d0f5638229760c`
- Until patched, restrict access to `app/del.php` at the web server or firewall level
- unknown whether a fixed release number exists beyond the patch commit

## Timeline

- 2026-10-26T07:28:50+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116223

## From the sources

A flaw has been found in icret EasyImage up to 2.8.7. The impacted element is an unknown function of the file app/del.php. Executing a manipulation of the argument hash can lead to improper privilege management. The attack can be launched remotely. The exploit has been published and may be used. This patch is called b12cb67d447bcbb67e21c8f011d0f5638229760c. A patch should be applied to remediate this issue.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_