CVE-2026-117566

MEDIUM 5.3

EasyImages2.0 through 2.8.6 Unauthenticated Path Traversal via down.php, thumb.php and info.php

CVSS Score

5.3

EPSS Score

0.0%

EPSS Percentile

0th

EasyImages2.0 through 2.8.6 contains an unauthenticated path traversal vulnerability in app/down.php, app/thumb.php and app/info.php that allows reading files outside the upload directory. Attackers can supply ../ sequences in the dw, history or img parameters to read files with allowed upload extensions from the server.

CWE	CWE-22
Vendor	icret
Product	easyimages2.0
Published	Oct 27, 2026

Stay Ahead of the Next One

Get instant alerts for icret easyimages2.0

Be the first to know when new medium vulnerabilities affecting icret easyimages2.0 are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Affected Versions

icret / EasyImages2.0

0 ≤ 2.8.6

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/icret/EasyImages2.0/issues/286 github.com: https://github.com/icret/EasyImages2.0 github.com: https://github.com/icret/EasyImages2.0/commit/e337a2bee7e7c67eb90bc4364a345c0857cb73aa github.com: https://github.com/icret/EasyImages2.0/blob/2.8.6/app/down.php#L17-L49 vulncheck.com: https://www.vulncheck.com/advisories/easyimages2-0-through-2.8.6-unauthenticated-path-traversal-via-down-php-thumb-php-and-info-php

Credits

hieuPenguinnn