CVE-2026-9506

HIGHNuclei

Path Traversal Vulnerability in Bagisto

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2026-9506 has a selected CVSS score of 8.7 (high); EIP currently links 1 Nuclei template.

Description

This vulnerability exists in Bagisto due to improper validation of user-supplied input in the ImageCacheController component. An unauthenticated remote attacker could exploit this vulnerability by sending crafted path traversal sequences through the filename parameter to access arbitrary files outside the intended directory on the targeted system. Successful exploitation of this vulnerability could allow an attacker to read arbitrary sensitive files on the targeted system.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Jun 8, 2026 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Bagisto

Browse Webkul / Bagisto

Default status: unaffected

CVE Listversion v2.4.1affected

Nuclei templates

1
ProjectDiscoveryHIGHBagisto <= 2.4.1 - Unauthenticated Arbitrary File ReadCVSS 8.7

Bagisto through 2.4.1 is vulnerable to unauthenticated path traversal in the ImageCache controller. The `original` image-cache route (/cache/original/{filename}) passes the user-supplied filename to getImagePath() without any '..' filtering or realpath containment, allowing a remote unauthenticated attacker to read files outside the intended public image directories (upload/images) - for example the application's composer.json, artisan and other source files.

Impact

Unauthenticated attackers can read arbitrary sensitive files, potentially exposing confidential information.

Remediation

Fixed in 2.4.2, which adds realpath() containment and '../' sanitisation.

WeaknessesCWE-22
Authorsstr4k3r
Template tagscvecve2026bagistowebkullfiunauth
CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Shodan: http.html:"Bagisto"
FOFA: body="bagisto"
https://github.com/advisories/GHSA-qhcg-rw5x-vg94 https://nvd.nist.gov/vuln/detail/CVE-2026-9506 https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0292 https://www.ionix.io/threat-center/cve-2026-9506/

Source: ProjectDiscovery

References

2