CVE-2026-117566
EasyImages2.0 through 2.8.6 Unauthenticated Path Traversal via down.php, thumb.php and info.php
icret EasyImages2.0
CVSS
6.9MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
EasyImages2.0 through 2.8.6 contains an unauthenticated path traversal vulnerability in app/down.php, app/thumb.php and app/info.php that allows reading files outside the upload directory. Attackers can supply ../ sequences in the dw, history or img parameters to read files with allowed upload extensions from the server.
Text from CVE List
Affected versions 1
- EasyImages2.0affected: all versions through 2.8.6CVE List
References 5
- github.com/icret/EasyImages2.0/commit/e337a2bee7e7c67eb90bc4364a345c0857cb73aaFixvia CVE List
- vulncheck.com/advisories/easyimages2-0-through-2.8.6-unauthenticated-path-traversal-via-down-php-thumb-php-and-info-phpAdvisoryvia CVE List
- github.com/icret/EasyImages2.0/issues/286Referencevia CVE List
- github.com/icret/EasyImages2.0Referencevia CVE List
- github.com/icret/EasyImages2.0/blob/2.8.6/app/down.php#L17-L49Referencevia CVE List