Vulnerability · Published Oct 27, 2026 · Assigned by VulnCheck
CVE-2026-117566EasyImages2.0 through 2.8.6 Unauthenticated Path Traversal via down.php, thumb.php and info.php
Medium 5.3
In plain English
A medium-severity path traversal in EasyImages2.0 from icret. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities).
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.4%top 70.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
EasyImages2.0 through 2.8.6 contains an unauthenticated path traversal vulnerability in app/down.php, app/thumb.php and app/info.php that allows reading files outside the upload directory. Attackers can supply ../ sequences in the dw, history or img parameters to read files with allowed upload extensions from the server.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| icret | EasyImages2.0 | 0 – through 2.8.6 |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
References
- GitHub Issue #286 issue-tracking
- https://github.com/icret/EasyImages2.0 product
- https://github.com/icret/EasyImages2.0/commit/e337a2bee7e7c67eb90bc4364a345c0857cb73aa patch
- https://github.com/icret/EasyImages2.0/blob/2.8.6/app/down.php#L17-L49 technical-description
- VulnCheck Advisory: EasyImages2.0 through 2.8.6 Unauthenticated Path Traversal via down.php, thumb.php and info.php third-party-advisory