CVE-2026-117566 in EasyImages
Summary
by MITRE • 10/27/2026
EasyImages2.0 through 2.8.6 contains an unauthenticated path traversal vulnerability in app/down.php, app/thumb.php and app/info.php that allows reading files outside the upload directory. Attackers can supply ../ sequences in the dw, history or img parameters to read files with allowed upload extensions from the server.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/27/2026
The EasyImages2.0 through 2.8.6 web application contains a critical unauthenticated path traversal vulnerability located within its core image processing and information retrieval scripts. Specifically, the flaw resides in app/down.php, app/thumb.php, and app/info.php, which are responsible for handling file downloads, thumbnail generation, and metadata display respectively. These endpoints fail to adequately sanitize user-supplied input before using it to construct filesystem paths. This lack of proper validation allows an attacker to manipulate the dw, history, or img parameters by injecting directory traversal sequences such as ../ into the request payload. By doing so, the application resolves these relative path references against the server's root directory rather than restricting access strictly to the designated upload folder where legitimate images are stored.
This technical flaw represents a classic instance of improper input validation leading to unauthorized file read operations. The vulnerability is categorized under CWE-22: Improper Limitation of a Pathname to a Restricted Directory, which highlights the failure to enforce strict boundaries on user-controlled path inputs. From an offensive security perspective, this aligns with ATT&CK technique T1083: File and Directory Discovery, as it enables adversaries to enumerate and access sensitive files residing outside the intended application scope. The attacker does not require authentication credentials, making this a remote unauthenticated attack vector that significantly lowers the barrier for exploitation.
The operational impact of this vulnerability is severe, particularly in environments where EasyImages2 is deployed on servers hosting other critical applications or storing sensitive configuration data. An attacker can exploit this flaw to read arbitrary files from the server's filesystem, provided those files have extensions allowed by the application's upload filter. This means that while binary executables might be blocked based on extension checks, text-based files such as .php source code, .conf configuration files containing database credentials or API keys, and .log files with sensitive operational data are fully accessible. The ability to read these files can lead directly to further compromise of the underlying system, including credential theft, intellectual property exposure, and potential remote code execution if sensitive script contents reveal implementation details that facilitate subsequent attacks.
Mitigation strategies must address both immediate remediation and long-term security posture improvements. The primary fix involves implementing strict input validation on all parameters passed to app/down.php, app/thumb.php, and app/info.php. Developers should enforce allowlisting of permitted characters for file paths and ensure that any resolved path is strictly confined within the intended upload directory using canonicalization techniques before accessing the filesystem. Additionally, employing chroot jails or containerized environments can limit the blast radius if such vulnerabilities are present in other components. For immediate risk reduction, web application firewalls should be configured to detect and block requests containing ../ sequences targeting these specific endpoints until a patched version of EasyImages2 is deployed. Regular security audits and static code analysis tools should also be integrated into the development lifecycle to prevent similar path traversal issues from being introduced in future updates.