CVE-2026-125385
INDOTALENT WHMS before 10.20261109 Path Traversal via FileDocument/GetDocument and FileImage/GetImage
CVSS Score
6.5
EPSS Score
0.0%
EPSS Percentile
0th
INDOTALENT WHMS before 10.20261109 contains a path traversal vulnerability that allows authenticated users to read arbitrary files via the documentName and imageName parameters. Attackers can self-register and supply traversal sequences to GetDocument or GetImage, which use Path.Combine without containment checks, to read files like appsettings.json.
| CWE | CWE-22 |
| Vendor | go2ismail |
| Product | asp.net-core-inventory-order-management-system |
| Published | Nov 9, 2026 |
Stay Ahead of the Next One
Get instant alerts for go2ismail asp.net-core-inventory-order-management-system
Be the first to know when new medium vulnerabilities affecting go2ismail asp.net-core-inventory-order-management-system are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Affected Versions
go2ismail / Asp.Net-Core-Inventory-Order-Management-System
0 < 10.20261109
References
github.com: https://github.com/go2ismail/Asp.Net-Core-Inventory-Order-Management-System/issues/48 github.com: https://github.com/go2ismail/Asp.Net-Core-Inventory-Order-Management-System github.com: https://github.com/go2ismail/Asp.Net-Core-Inventory-Order-Management-System/blob/v9.20250118/Infrastructure/Infrastructure/FileDocumentManager/FileDocumentService.cs#L78-L89 github.com: https://github.com/go2ismail/Asp.Net-Core-Inventory-Order-Management-System/commit/65609b5b88cb4f156e8164f33b8db8c63f5c125b github.com: https://github.com/go2ismail/Asp.Net-Core-Inventory-Order-Management-System/commit/ded7d8a9457c780dfd4f5ea74d7e72111fafaea6 github.com: https://github.com/go2ismail/Asp.Net-Core-Inventory-Order-Management-System/releases/tag/v10.20261109 vulncheck.com: https://www.vulncheck.com/advisories/indotalent-whms-before-10.20261109-path-traversal-via-filedocument-getdocument-and-fileimage-getimage
Credits
hieuPenguinnn