CVE-2026-36767: Path Traversal
Published Apr 30, 2026
·Updated
A path traversal vulnerability in the /content/images/add endpoint of shopizer v3.2.5 allows attackers write arbitrary files to any writeable path via a crafted POST request.
Affected Software
1 affected component
Shopizer Shopizer=3.2.5
Event History
Apr 30, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·05:16 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2026-36767?
The severity of CVE-2026-36767 has not been explicitly rated, but it represents a significant risk due to its ability to allow arbitrary file writes.
2
How do I fix CVE-2026-36767?
To fix CVE-2026-36767, update Shopizer to a version that addresses the path traversal vulnerability.
3
What software is affected by CVE-2026-36767?
CVE-2026-36767 affects Shopizer version 3.2.5.
4
What type of vulnerability is CVE-2026-36767?
CVE-2026-36767 is classified as a path traversal vulnerability.
5
What can an attacker do with CVE-2026-36767?
An attacker can exploit CVE-2026-36767 to write arbitrary files to any writable path on the server.