CVE-2026-18959 in InnoShop
Summary
by MITRE • 08/06/2026
A flaw has been found in yushine InnoShop up to 0.8.2. Affected by this issue is the function FileManagerController::destroyFiles of the file innopacks/restapi/routes/panel-api.php of the component Files Endpoint. This manipulation causes path traversal. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/06/2026
The vulnerability identified in yushine InnoShop version 0.8.2 represents a critical path traversal flaw within the FileManagerController::destroyFiles function located in innopacks/restapi/routes/panel-api.php. This security weakness allows remote attackers to manipulate file system operations by exploiting improper input validation mechanisms that fail to adequately sanitize user-supplied paths. The vulnerability exists at the intersection of improper input validation and inadequate access controls, creating a pathway for unauthorized file system interactions that could lead to data exposure or manipulation.
The technical implementation of this flaw stems from insufficient sanitization of file path parameters within the Files Endpoint functionality. When the destroyFiles method processes user requests, it fails to properly validate or filter incoming path variables, enabling attackers to craft malicious inputs that traverse directory structures beyond the intended scope. This vulnerability directly maps to CWE-22 Path Traversal and aligns with ATT&CK technique T1074 Data Staged, as it enables unauthorized access to sensitive file system resources through remote exploitation.
Remote exploitation of this vulnerability presents significant operational risks to affected systems, as attackers can leverage published exploits to gain unauthorized access to file system resources without requiring local system access or authentication credentials. The attack surface expands when considering that the vendor failed to respond to early disclosure attempts, suggesting potential delays in patch development or deployment that leave systems exposed for extended periods. This scenario increases the likelihood of successful exploitation and demonstrates inadequate security response protocols within the vendor's vulnerability management process.
Organizations utilizing affected yushine InnoShop installations should immediately implement network-level mitigations including firewall rules that restrict access to the vulnerable API endpoints, particularly those related to file management operations. The recommended approach involves applying the latest available patches from the vendor upon release, implementing proper input validation mechanisms at multiple layers of the application stack, and conducting comprehensive security assessments to identify additional potential vulnerabilities within the system architecture. Additionally, organizations should consider deploying intrusion detection systems that can monitor for suspicious path traversal patterns and implement regular security audits to ensure proper access controls remain in place.