Vulnerability · Published Mar 8, 2026 · Assigned by VulDB
CVE-2026-3695SourceCodester Modern Image Gallery App delete.php path traversal
Medium 6.5
In plain English
A medium-severity path traversal in Modern Image Gallery App from SourceCodester. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities).
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.9%top 40.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
A vulnerability has been found in SourceCodester Modern Image Gallery App 1.0. Impacted is an unknown function of the file /delete.php. Such manipulation of the argument filename leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SourceCodester | Modern Image Gallery App | 1.0 |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R
References
- VDB-349641 | SourceCodester Modern Image Gallery App delete.php path traversal vdb-entry, technical-description
- VDB-349641 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- Submit #765591 | SourceCodester Modern Image Gallery App v1.0 Path Traversal third-party-advisory
- https://gist.github.com/hackusman/e618b915514ed24b9333c72152bb7218 related
- https://gist.github.com/hackusman/e618b915514ed24b9333c72152bb7218#-detailed-proof-of-concept-poc exploit
- https://www.sourcecodester.com/ product