Live › vulnerability › CVE-2026-117566
Go to dashboardEasyImages 2.0 through 2.8.6 has a path traversal flaw in app/down.php, app/thumb.php and app/info.php. An unauthenticated attacker can use ../ sequences in the dw, history or img parameters to read files with allowed upload extensions from the server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 14:32 UTC. All times on this page are UTC.
Any site running EasyImages 2.0 through 2.8.6 with the app/down.php, app/thumb.php or app/info.php endpoints reachable from the internet is exposed, because no login is needed to send the traversal parameters. The sources do not say whether a default install exposes these files. Teams not running EasyImages can skip it.
No product ranges from the sources yet.
2.8.6; the sources do not name the fixed versionEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
EasyImages2.0 through 2.8.6 contains an unauthenticated path traversal vulnerability in app/down.php, app/thumb.php and app/info.php that allows reading files outside the upload directory. Attackers can supply ../ sequences in the dw, history or img parameters to read files with allowed upload extensions from the server.
This page as .md · .json · in your agent: get_signal("CVE-2026-117566")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.