CVE-2026-116223— icret EasyImage del.php privileges management

Quick assessment

Affected

icret EasyImage

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 icret EasyImage 2.8.7 及更早版本中发现了一个漏洞。受影响的是文件 app/del.php 中的某个未知函数。通过操纵该函数的 hash 参数，可能导致权限管理不当。该攻击可远程发起，且利用代码已公开，可能被利用。修复此问题的补丁标识为 b12cb67d447bcbb67e21c8f011d0f5638229760c，建议尽快应用该补丁以修复此问题。

CVSS 6.5 · Medium Updated Oct 26, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

icret EasyImage del.php privileges management

Source: CVE Program / CVE List V5

Vulnerability Description

A flaw has been found in icret EasyImage up to 2.8.7. The impacted element is an unknown function of the file app/del.php. Executing a manipulation of the argument hash can lead to improper privilege management. The attack can be launched remotely. The exploit has been published and may be used. This patch is called b12cb67d447bcbb67e21c8f011d0f5638229760c. A patch should be applied to remediate this issue.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Source: CVE Program / CVE List V5

Vulnerability Type

特权管理不恰当

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
icret	EasyImage	2.8.0	`cpe:2.3:a:icret:easyimage::::::::`

II. Public POCs for CVE-2026-116223

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-116223

请登录查看更多情报信息。

Other References for CVE-2026-116223 (7)

https://gist.github.com/yyz8097/bc58546872ad90208d2b35260d84b1d9 exploit
https://github.com/icret/EasyImages2.0/issues/283 issue-tracking
https://github.com/icret/EasyImages2.0/commit/b12cb67d447bcbb67e21c8f011d0f5638229760c patch
https://vuldb.com/cve/CVE-2026-116223 third-party-advisory
https://vuldb.com/vuln/426203/cti signature permissions-required
https://vuldb.com/vuln/426203 vdb-entry technical-description
https://vuldb.com/submit/1004976 third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-116223

IV. Related Vulnerabilities

Same vendor: icret

Same weakness: CWE-269