CVE-2026-9506.md

CVE-2026-9506 — Path Traversal Vulnerability (Webkul Bagisto)

Severity: High (8.7) CWE: CWE-22

Summary

Improper validation of user-supplied input in the ImageCacheController component allows an unauthenticated remote attacker to perform path traversal and access arbitrary files outside the intended directory.

Impact

• Arbitrary file read
• Disclosure of sensitive information
• Access to files outside the restricted directory

Fix

Properly validate and sanitize user-controlled input, restrict file paths to the intended directory, and implement secure path normalization.

References

• https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0292
• https://www.cve.org/CVERecord?id=CVE-2026-9506

Credits

Stalin S.