[ CVE-2026-117566 · Published 27 Oct 2026 ]
Vulnerability in icret EasyImages2.0
CVSS 5.3
EPSS <1%No fix listed yet
[ Description ]Official description
EasyImages2.0 through 2.8.6 contains an unauthenticated path traversal vulnerability in app/down.php, app/thumb.php and app/info.php that allows reading files outside the upload directory. Attackers can supply ../ sequences in the dw, history or img parameters to read files with allowed upload extensions from the server.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.