CVE-2026-82665: yaojingang GEOFlow Image Library Cleanup ImageLibraryController.php unlink path traversal
A vulnerability was detected in yaojingang GEOFlow up to 2.1.0. This vulnerability affects the function unlink of the file app/Http/Controllers/Admin/ImageLibraryController.php of the component Image Library Cleanup. The manipulation of the argument filepath results in path traversal. The attack may be performed from remote. The exploit is now public and may be used. Upgrading to version 2.1.1 is able to resolve this issue. The patch is identified as 67abfd864a15d169a78429f3290c91cb3b93e849. It is recommended to upgrade the affected component.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
yaojingang GEOFlow Image Library Cleanup (ImageLibraryController.php)to a version that resolves this vulnerability.Fixed in 2.1.1Patch 67abfd864a15d169a78429f3290c91cb3b93e849
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs high privileges, but exploitation can be performed remotely and does not require user interaction. The affected functionality is the Image Library Cleanup component.
Which versions are affected and what fixes the issue?
yaojingang GEOFlow versions up to and including 2.1.0 are affected. Upgrade to version 2.1.1, which includes patch 67abfd864a15d169a78429f3290c91cb3b93e849.
What is the likely impact of successful exploitation?
The vulnerability allows path traversal through the file_path argument used by the unlink function. The supplied severity vector indicates integrity and availability impact, with no confidentiality impact.
How urgent is remediation?
The issue has a low base severity score of 3.8, but public exploit availability is reported. Prioritize upgrading systems where high-privileged remote users can access Image Library Cleanup.