Description
EasyImages2.0 through 2.8.6 contains an unauthenticated path traversal vulnerability in app/down.php, app/thumb.php and app/info.php that allows reading files outside the upload directory. Attackers can supply ../ sequences in the dw, history or img parameters to read files with allowed upload extensions from the server.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| icret | EasyImages2.0 | ≤ 2.8.6 | — |
References
- GitHub Issue #286 issue-tracking
- https://github.com/icret/EasyImages2.0 product
- https://github.com/icret/EasyImages2.0/commit/e337a2bee7e7c67eb90bc4364a345c0857cb73aa patch
- https://github.com/icret/EasyImages2.0/blob/2.8.6/app/down.php#L17-L49 technical-description
- VulnCheck Advisory: EasyImages2.0 through 2.8.6 Unauthenticated Path Traversal via down.php, thumb.php and info.php third-party-advisory