CVE-2026-9506— Bagisto 路径遍历漏洞

Path Traversal Vulnerability in Bagisto

This vulnerability exists in Bagisto due to improper validation of user-supplied input in the ImageCacheController component. An unauthenticated remote attacker could exploit this vulnerability by sending crafted path traversal sequences through the filename parameter to access arbitrary files outside the intended directory on the targeted system. Successful exploitation of this vulnerability could allow an attacker to read arbitrary sensitive files on the targeted system.

N/A

对路径名的限制不恰当(路径遍历)

Bagisto 路径遍历漏洞

Bagisto是印度Webkul Software开源的一套开源的电子商务框架。 Bagisto存在路径遍历漏洞，该漏洞源于ImageCacheController组件中用户提供输入的验证不当，允许未经身份验证的远程攻击者通过filename参数发送特制路径遍历序列访问目标系统上预期目录之外的任意文件，成功利用可能导致攻击者读取目标系统上的任意敏感文件。

N/A

N/A