CVE-2026-117566: EasyImages2.0 through 2.8.6 Unauthenticated Path Traversal via down.php, thumb.php and info.php
EasyImages2.0 through 2.8.6 contains an unauthenticated path traversal vulnerability in app/down.php, app/thumb.php and app/info.php that allows reading files outside the upload directory. Attackers can supply ../ sequences in the dw, history or img parameters to read files with allowed upload extensions from the server.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any remote attacker who can reach the affected application endpoints can attempt exploitation. Authentication is not required, and the attack has low complexity with no user interaction required.
What information can an attacker read?
The flaw can expose files outside the upload directory, but only files whose extensions are allowed by the application's upload-extension restrictions. The affected request parameters are dw, history, and img.
Which endpoints should be reviewed for exposure?
Review app/down.php, app/thumb.php, and app/info.php. These endpoints are affected through EasyImages2.0 version 2.8.6.
How can I determine whether an installation is affected?
An installation is affected if it runs EasyImages2.0 2.8.6 or an earlier version and exposes the affected PHP endpoints. Testing should focus on whether ../ sequences in the dw, history, or img parameters can resolve files outside the upload directory.