{"schema":"threatline.record/2","record":{"id":"CVE-2026-103896","aliases":[],"summary":"10Web Booster <= 2.34.5 - Unauthenticated Limited File Write / Cache Poisoning via Query-string Parameter Traversal in Page-Cache Path","details":"The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to a limited file write via path traversal in versions up to, and including, 2.34.5 This is due to the OptimizerWebPageCache::get_cache_file_dir() function concatenating raw, unsanitized $_GET parameter names and values into the on-disk cache path, and the cache_content() sink calling mkdir() and file_put_contents() on the result with no realpath containment check — unlike the sibling delete_page_cache(), which does perform one. This makes it possible for unauthenticated attackers to create arbitrary directories (mode 0777, recursively) outside the cache root and write a cached page into them. The write is LIMITED: the filename is always 'source.html', so the extension is fixed, and the content is the rendered page buffer rather than attacker-supplied data. PHP files cannot be written and code execution is not possible; the demonstrated impact is cache poisoning and arbitrary directory creation.","categories":["Unclassified"],"product":"10Web Booster – Website speed optimization, Cache & Page Speed optimizer","vendor":"10web","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-103896","source_modified_at":"2026-10-16T15:09:39.142Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"10Web Booster – Website speed optimization, Cache & Page Speed optimizer","vendor":"10web","versions":[{"version":"0","status":"affected","lessThanOrEqual":"2.34.5","versionType":"semver"}],"defaultStatus":"unaffected"}],"fixed_versions":[],"cvss":7.5,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00464,"percentile":0.39245,"score_date":"2026-10-23"},"published_at":"2026-10-16T05:30:24.365Z","modified_at":"2026-10-16T15:09:39.142Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-103896","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-16T15:09:39.142Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-103896","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/83e672e7-2483-46e9-ae16-a9e7ccc4bcb8?source=cve"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/tenweb-speed-optimizer/tags/2.34.5/includes/WebPageCache/OptimizerWebPageCache.php#L205"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/tenweb-speed-optimizer/tags/2.34.5/includes/WebPageCache/OptimizerWebPageCache.php#L190"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/tenweb-speed-optimizer/tags/2.34.5/includes/WebPageCache/OptimizerWebPageCache.php#L312"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/tenweb-speed-optimizer/tags/2.34.5/includes/WebPageCache/OptimizerWebPageValidations.php#L299"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/tenweb-speed-optimizer/tags/2.34.8"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"yes","technical_impact":"partial","assessed_at":"2026-10-16T14:55:48.533241Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-16T15:09:39.142Z","content_hash":"96fcfc34bfcb4eaf2b5b1caa98e7a6cbc8b6899548c16aa943029f2b47ff10fd"}}