CVE-2026-9506: Path Traversal Vulnerability in Bagisto
This vulnerability exists in Bagisto due to improper validation of user-supplied input in the ImageCacheController component. An unauthenticated remote attacker could exploit this vulnerability by sending crafted path traversal sequences through the filename parameter to access arbitrary files outside the intended directory on the targeted system.
Successful exploitation of this vulnerability could allow an attacker to read arbitrary sensitive files on the targeted system.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Bagistoto a version that resolves this vulnerability.Fixed in v2.4.2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9506?
The severity of CVE-2026-9506 is high with a CVSS score of 8.7.
How do I fix CVE-2026-9506?
To fix CVE-2026-9506, upgrade Bagisto to version 2.4.2 or later.
What type of vulnerability is CVE-2026-9506?
CVE-2026-9506 is a path traversal vulnerability in the Bagisto platform.
Can CVE-2026-9506 be exploited by unauthenticated users?
Yes, an unauthenticated remote attacker can exploit CVE-2026-9506.
What component in Bagisto is affected by CVE-2026-9506?
CVE-2026-9506 affects the ImageCacheController component in Bagisto.