CVE-2026-78394: Link Library < 7.9.6 - Contributor+ Path Traversal via 'filepath' Parameter
The Link Library WordPress plugin before 7.9.6 does not sanitize a user-supplied destination folder before writing a generated image to disk, allowing users with the Contributor role and above to create directories and write or overwrite image files anywhere the web server can write, including outside the site's document root.
The written file name is always numeric with a fixed image extension, so executable code cannot be planted this way.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Link Library WordPress pluginto a version that resolves this vulnerability.Fixed in 7.9.6
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated WordPress user with the Contributor role or any higher-privileged role can exploit it. Unauthenticated visitors are not described as able to trigger the vulnerable behavior.
What access does an attacker need to write files outside the site directory?
The attacker needs a Contributor-or-higher account and must be able to supply the destination folder through the filepath parameter. The resulting writes are limited to locations writable by the web server.
Can this vulnerability be used to upload a PHP shell or other executable code?
The generated filename is numeric and uses a fixed image extension, so the issue cannot directly plant executable code. It can still create directories and write or overwrite image files, including outside the document root where the web server has write permission.
Which versions are affected?
Link Library versions before 7.9.6 are affected. Updating to version 7.9.6 or later addresses the described unsanitized destination-folder handling.