All vulnerabilities
CVE-2026-108591

InnoShop 0.9.2 Local File Disclosure via AI Core MCP file_upload Tool

innocommerce InnoShop
Open in ThreatlineRecord JSON
CVSS
5.9Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.27%Chance of exploitation activity in the next 30 days, higher than 18% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
Published10 Oct 2026Updated 18 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Description

InnoShop 0.9.2 contains a local file disclosure vulnerability that allows authenticated administrators with files_create permission to read server files by abusing the AI Core MCP file_upload tool's source argument. Attackers can supply file:// or php:// stream wrappers passed to file_get_contents(), storing contents on the public media disk to expose the .env file with APP_KEY and database credentials.

Text from CVE List

Affected versions 1

  • InnoShopaffected: 0.9.2 through 0.9.2CVE List

References 5