74 matches found
CVE-2026-108591
InnoShop 0.9.2 contains a local file disclosure vulnerability that allows authenticated administrators with filescreate permission to read server files by abusing the AI Core MCP fileupload tool's source argument. Attackers can supply file:// or php:// stream wrappers passed to filegetcontents,...
CVE-2026-108591
InnoShop 0.9.2 contains a local file disclosure vulnerability that allows authenticated administrators with filescreate permission to read server files by abusing the AI Core MCP fileupload tool's source argument. Attackers can supply file:// or php:// stream wrappers passed to filegetcontents,...
CVE-2026-108591 InnoShop 0.9.2 Local File Disclosure via AI Core MCP file_upload Tool
InnoShop 0.9.2 contains a local file disclosure vulnerability that allows authenticated administrators with filescreate permission to read server files by abusing the AI Core MCP fileupload tool's source argument. Attackers can supply file:// or php:// stream wrappers passed to filegetcontents,...
EUVD-2026-96403
InnoShop 0.9.2 contains a local file disclosure vulnerability that allows authenticated administrators with filescreate permission to read server files by abusing the AI Core MCP fileupload tool's source argument. Attackers can supply file:// or php:// stream wrappers passed to filegetcontents,...
CVE-2026-108591 InnoShop 0.9.2 Local File Disclosure via AI Core MCP file_upload Tool
InnoShop 0.9.2 contains a local file disclosure vulnerability that allows authenticated administrators with filescreate permission to read server files by abusing the AI Core MCP fileupload tool's source argument. Attackers can supply file:// or php:// stream wrappers passed to filegetcontents,...
CVE-2026-108591
InnoShop version 0.9.2 is vulnerable to a local file disclosure vulnerability. Authenticated administrators with files_create permissions can read sensitive server files by abusing the AI Core MCP file_upload tool's source argument. By providing file:// or php:// stream wrappers to the file_get_c...
CVE-2026-108591 InnoShop 0.9.2 Local File Disclosure via AI Core MCP file_upload Tool
InnoShop 0.9.2 contains a local file disclosure vulnerability that allows authenticated administrators with filescreate permission to read server files by abusing the AI Core MCP fileupload tool's source argument. Attackers can supply file:// or php:// stream wrappers passed to filegetcontents,...
PT-2026-109731
Name of the Vulnerable Software and Affected Versions InnoShop version 0.9.2 Description An issue exists that allows authenticated administrators with files create permission to read server files. This is achieved by abusing the source argument of the AI Core MCP file upload tool. By providing...
CVE-2026-108591: External Control of File Name or Path
InnoShop 0.9.2 contains a local file disclosure vulnerability that allows authenticated administrators with filescreate permission to read server files by abusing the AI Core MCP fileupload tool's source argument. Attackers can supply file:// or php:// stream wrappers passed to filegetcontents,...
InnoShop input validation error vulnerability
InnoShop version 0.9.2 has a vulnerability in input validation. This vulnerability stems from improper handling of the source parameter in the AI Core MCP fileUpload tool. It allows authenticated administrators with the filescreate permission to use the file:// or php:// stream wrapper to read...
CVE-2026-18959
A flaw has been found in yushine InnoShop up to 0.8.2. Affected by this issue is the function FileManagerController::destroyFiles of the file innopacks/restapi/routes/panel-api.php of the component Files Endpoint. This manipulation causes path traversal. The attack may be initiated remotely. The...
CVE-2026-18959 yushine InnoShop Files Endpoint panel-api.php destroyFiles path traversal
A flaw has been found in yushine InnoShop up to 0.8.2. Affected by this issue is the function FileManagerController::destroyFiles of the file innopacks/restapi/routes/panel-api.php of the component Files Endpoint. This manipulation causes path traversal. The attack may be initiated remotely. The...
CVE-2026-18959 yushine InnoShop Files Endpoint panel-api.php destroyFiles path traversal
A flaw has been found in yushine InnoShop up to 0.8.2. Affected by this issue is the function FileManagerController::destroyFiles of the file innopacks/restapi/routes/panel-api.php of the component Files Endpoint. This manipulation causes path traversal. The attack may be initiated remotely. The...
CVE-2026-18959
A flaw has been found in yushine InnoShop up to 0.8.2. Affected by this issue is the function FileManagerController::destroyFiles of the file innopacks/restapi/routes/panel-api.php of the component Files Endpoint. This manipulation causes path traversal. The attack may be initiated remotely. The...
CVE-2026-18959
A flaw has been found in yushine InnoShop up to 0.8.2. Affected by this issue is the function FileManagerController::destroyFiles of the file innopacks/restapi/routes/panel-api.php of the component Files Endpoint. This manipulation causes path traversal. The attack may be initiated remotely. The...
EUVD-2026-53614
A flaw has been found in yushine InnoShop up to 0.8.2. Affected by this issue is the function FileManagerController::destroyFiles of the file innopacks/restapi/routes/panel-api.php of the component Files Endpoint. This manipulation causes path traversal. The attack may be initiated remotely. The...
CVE-2026-18959
CVE-2026-18959 affects yushine InnoShop (up to 0.8.2). The vulnerability resides in the Files Endpoint, specifically FileManagerController::destroyFiles in innopacks/restapi/routes/panel-api.php, which enables path traversal. It can be triggered remotely and an exploit has been published. The dis...
CVE-2026-18959: Improper Limitation of a Pathname to a Restricted Directory
A flaw has been found in yushine InnoShop up to 0.8.2. Affected by this issue is the function FileManagerController::destroyFiles of the file innopacks/restapi/routes/panel-api.php of the component Files Endpoint. This manipulation causes path traversal. The attack may be initiated remotely. The...
PT-2026-68326
Name of the Vulnerable Software and Affected Versions yushine InnoShop versions prior to 0.8.2 Description A path traversal flaw exists in the Files Endpoint component. This issue occurs within the FileManagerController::destroyFiles function located in the innopacks/restapi/routes/panel-api.php...
