CVE-2026-116223: icret EasyImage del.php privileges management
A flaw has been found in icret EasyImage up to 2.8.7. The impacted element is an unknown function of the file app/del.php. Executing a manipulation of the argument hash can lead to improper privilege management. The attack can be launched remotely. The exploit has been published and may be used. This patch is called b12cb67d447bcbb67e21c8f011d0f5638229760c. A patch should be applied to remediate this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
icret EasyImageto a version that resolves this vulnerability.Patch b12cb67d447bcbb67e21c8f011d0f5638229760c
Event History
Frequently Asked Questions
Which deployments are affected?
icret EasyImage versions up to and including 2.8.7 are affected. The vulnerable component is app/del.php.
Can this be exploited without authentication or user interaction?
Yes. The published vector is network-accessible, requires low attack complexity, and does not require privileges or user interaction.
What is the practical impact of successful exploitation?
Manipulating the hash argument in app/del.php can cause improper privilege management. The assigned metrics indicate low integrity and availability impact, with no confidentiality impact.
What should teams do if they are affected?
Apply patch b12cb67d447bcbb67e21c8f011d0f5638229760c. The exploit has been published, so affected internet-accessible deployments should be prioritized.