CVE-2026-117566

EasyImages2.0 through 2.8.6 contains an unauthenticated path traversal vulnerability in app/down.php, app/thumb.php and app/info.php that allows reading files outside the upload directory. Attackers can supply ../ sequences in the dw, history or img parameters to read files with allowed upload...

CVE-2026-117566

EasyImages versions 2.0 through 2.8.6 are vulnerable to an unauthenticated path traversal vulnerability in the app/down.php , app/thumb.php , and app/info.php components. The root cause is the improper limitation of pathnames, where attackers can supply ../ sequences in the dw , history , or img ...

CVE-2026-117566 EasyImages2.0 through 2.8.6 Unauthenticated Path Traversal via down.php, thumb.php and info.php

EasyImages2.0 through 2.8.6 contains an unauthenticated path traversal vulnerability in app/down.php, app/thumb.php and app/info.php that allows reading files outside the upload directory. Attackers can supply ../ sequences in the dw, history or img parameters to read files with allowed upload...

EUVD-2026-110844

EasyImages2.0 through 2.8.6 contains an unauthenticated path traversal vulnerability in app/down.php, app/thumb.php and app/info.php that allows reading files outside the upload directory. Attackers can supply ../ sequences in the dw, history or img parameters to read files with allowed upload...

PT-2026-126425

EasyImages2.0 through 2.8.6 contains an unauthenticated path traversal vulnerability in app/down.php, app/thumb.php and app/info.php that allows reading files outside the upload directory. Attackers can supply ../ sequences in the dw, history or img parameters to read files with allowed upload...

balebot (>=1.2.8, <=1.8.15), demosys-py (>=1.0.6, <=2.0.3) +19 more potentially affected by CVE-2026-54058 via pillow (5.2.0)

pillow PYPI version 5.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - balebot =1.2.8, =1.0.6, =0.3.0, =1.0.7, =1.2.1, =1.8.3, =2.1.0, =2.0.3, =2.1.0 - poltools 1.0.0 and more Source cves: CVE-2026-54058 Source advisory...

balebot (>=1.2.8, <=1.8.15), demosys-py (>=1.0.6, <=2.0.3) +19 more potentially affected by CVE-2026-59205 via pillow (5.2.0)

pillow PYPI version 5.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - balebot =1.2.8, =1.0.6, =0.3.0, =1.0.7, =1.2.1, =1.8.3, =2.1.0, =2.0.3, =2.1.0 - poltools 1.0.0 and more Source cves: CVE-2026-59205 Source advisory...

balebot (>=1.2.8, <=1.8.15), demosys-py (>=1.0.6, <=2.0.3) +19 more potentially affected by CVE-2026-59199 via pillow (5.2.0)

pillow PYPI version 5.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - balebot =1.2.8, =1.0.6, =0.3.0, =1.0.7, =1.2.1, =1.8.3, =2.1.0, =2.0.3, =2.1.0 - poltools 1.0.0 and more Source cves: CVE-2026-59199 Source advisory...

balebot (>=1.2.8, <=1.8.15), demosys-py (>=1.0.6, <=2.0.3) +19 more potentially affected by CVE-2026-55798 via pillow (5.2.0)

pillow PYPI version 5.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - balebot =1.2.8, =1.0.6, =0.3.0, =1.0.7, =1.2.1, =1.8.3, =2.1.0, =2.0.3, =2.1.0 - poltools 1.0.0 and more Source cves: CVE-2026-55798 Source advisory...

balebot (>=1.2.8, <=1.8.15), demosys-py (>=1.0.6, <=2.0.3) +19 more potentially affected by CVE-2026-55380 via pillow (5.2.0)

pillow PYPI version 5.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - balebot =1.2.8, =1.0.6, =0.3.0, =1.0.7, =1.2.1, =1.8.3, =2.1.0, =2.0.3, =2.1.0 - poltools 1.0.0 and more Source cves: CVE-2026-55380 Source advisory...

balebot (>=1.2.8, <=1.8.15), demosys-py (>=1.0.6, <=2.0.3) +19 more potentially affected by CVE-2026-55379 via pillow (5.2.0)

pillow PYPI version 5.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - balebot =1.2.8, =1.0.6, =0.3.0, =1.0.7, =1.2.1, =1.8.3, =2.1.0, =2.0.3, =2.1.0 - poltools 1.0.0 and more Source cves: CVE-2026-55379 Source advisory...

balebot (>=1.2.8, <=1.8.15), demosys-py (>=1.0.6, <=2.0.3) +19 more potentially affected by CVE-2026-54060 via pillow (5.2.0)

pillow PYPI version 5.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - balebot =1.2.8, =1.0.6, =0.3.0, =1.0.7, =1.2.1, =1.8.3, =2.1.0, =2.0.3, =2.1.0 - poltools 1.0.0 and more Source cves: CVE-2026-54060 Source advisory...

balebot (>=1.2.8, <=1.8.15), demosys-py (>=1.0.6, <=2.0.3) +19 more potentially affected by CVE-2026-54059 via pillow (5.2.0)

pillow PYPI version 5.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - balebot =1.2.8, =1.0.6, =0.3.0, =1.0.7, =1.2.1, =1.8.3, =2.1.0, =2.0.3, =2.1.0 - poltools 1.0.0 and more Source cves: CVE-2026-54059 Source advisory...

balebot (>=1.2.8, <=1.8.15), demosys-py (>=1.0.6, <=2.0.3) +19 more potentially affected by CVE-2026-59197 via pillow (5.2.0)

pillow PYPI version 5.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - balebot =1.2.8, =1.0.6, =0.3.0, =1.0.7, =1.2.1, =1.8.3, =2.1.0, =2.0.3, =2.1.0 - poltools 1.0.0 and more Source cves: CVE-2026-59197 Source advisory...

autodiffy (0.0.2.4), easyimages (>=0.7.5, <=0.8.0) +5 more potentially affected by CVE-2025-71176 via pytest (3.4.2)

pytest PYPI version 3.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on pytest and may be impacted: - autodiffy 0.0.2.4 - easyimages =0.7.5, =1.0.1.dev1, =0.1.1, =1.7.4, =1.7.5 Source cves: CVE-2025-71176 Source advisory: OSV:PYSEC-2026-1845...

balebot (>=1.2.8, <=1.8.15), demosys-py (>=1.0.6, <=2.0.3) +19 more potentially affected by CVE-2026-55380 via pillow (5.2.0)

pillow PYPI version 5.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - balebot =1.2.8, =1.0.6, =0.3.0, =1.0.7, =1.2.1, =1.8.3, =2.1.0, =2.0.3, =2.1.0 - poltools 1.0.0 and more Source cves: CVE-2026-55380 Source advisory...

balebot (>=1.2.8, <=1.8.15), demosys-py (>=1.0.6, <=2.0.3) +19 more potentially affected by CVE-2026-55798 via pillow (5.2.0)

pillow PYPI version 5.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - balebot =1.2.8, =1.0.6, =0.3.0, =1.0.7, =1.2.1, =1.8.3, =2.1.0, =2.0.3, =2.1.0 - poltools 1.0.0 and more Source cves: CVE-2026-55798 Source advisory...

balebot (>=1.2.8, <=1.8.15), demosys-py (>=1.0.6, <=2.0.3) +19 more potentially affected by CVE-2026-54059 via pillow (5.2.0)

pillow PYPI version 5.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - balebot =1.2.8, =1.0.6, =0.3.0, =1.0.7, =1.2.1, =1.8.3, =2.1.0, =2.0.3, =2.1.0 - poltools 1.0.0 and more Source cves: CVE-2026-54059 Source advisory...

autodiffy (0.0.2.4), easyimages (>=0.7.5, <=0.8.0) +5 more potentially affected by CVE-2025-71176 via pytest (3.4.2)

pytest PYPI version 3.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on pytest and may be impacted: - autodiffy 0.0.2.4 - easyimages =0.7.5, =1.0.1.dev1, =0.1.1, =1.7.4, =1.7.5 Source cves: CVE-2025-71176 Source advisory: OSV:GHSA-6W46-J5RX-G56G...

CVE-2025-65472

A Cross-Site Request Forgery CSRF in the /admin/admin.inc.php component of EasyImages 2.0 v2.8.6 and below allows attackers to escalate privileges to Administrator via user interaction with a malicious web page...