Search
Find a vulnerability
Search criteria
2 vulnerabilities found for InnoShop by yushine
CVE-2026-18959 (GCVE-0-2026-18959)
Vulnerability from nvd – Published: 2026-08-05 20:15 – Updated: 2026-08-06 17:32
VLAI
EPSS
VEX
Title
yushine InnoShop Files Endpoint panel-api.php destroyFiles path traversal
Summary
A flaw has been found in yushine InnoShop up to 0.8.2. Affected by this issue is the function FileManagerController::destroyFiles of the file innopacks/restapi/routes/panel-api.php of the component Files Endpoint. This manipulation causes path traversal. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-06 17:30 UTC
CWE
- CWE-22 - Path Traversal
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/386234 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/386234/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-18959 | third-party-advisory |
| https://vuldb.com/submit/860109 | third-party-advisory |
| https://github.com/ofirbarum923-dot/small-web-vul… | exploitissue-tracking |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-18959",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-06T17:30:11.582249Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-06T17:32:18.463Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:yushine:innoshop:*:*:*:*:*:*:*:*"
],
"modules": [
"Files Endpoint"
],
"product": "InnoShop",
"vendor": "yushine",
"versions": [
{
"status": "affected",
"version": "0.8.0"
},
{
"status": "affected",
"version": "0.8.1"
},
{
"status": "affected",
"version": "0.8.2"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "HackTen (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw has been found in yushine InnoShop up to 0.8.2. Affected by this issue is the function FileManagerController::destroyFiles of the file innopacks/restapi/routes/panel-api.php of the component Files Endpoint. This manipulation causes path traversal. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5.5,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "Path Traversal",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T20:15:10.144Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-386234 | yushine InnoShop Files Endpoint panel-api.php destroyFiles path traversal",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/386234"
},
{
"name": "VDB-386234 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/386234/cti"
},
{
"name": "CVE-2026-18959 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-18959"
},
{
"name": "Submit #860109 | yushine innoshop 0/8/2 Arbitrary File Deletion",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/860109"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/ofirbarum923-dot/small-web-vuln/issues/1"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-05T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-05T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-05T16:10:50.000Z",
"value": "VulDB entry last update"
}
],
"title": "yushine InnoShop Files Endpoint panel-api.php destroyFiles path traversal",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-18959",
"datePublished": "2026-08-05T20:15:10.144Z",
"dateReserved": "2026-08-05T14:05:45.834Z",
"dateUpdated": "2026-08-06T17:32:18.463Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-18959 (GCVE-0-2026-18959)
Vulnerability from cvelistv5 – Published: 2026-08-05 20:15 – Updated: 2026-08-06 17:32
VLAI
EPSS
VEX
Title
yushine InnoShop Files Endpoint panel-api.php destroyFiles path traversal
Summary
A flaw has been found in yushine InnoShop up to 0.8.2. Affected by this issue is the function FileManagerController::destroyFiles of the file innopacks/restapi/routes/panel-api.php of the component Files Endpoint. This manipulation causes path traversal. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-06 17:30 UTC
CWE
- CWE-22 - Path Traversal
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/386234 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/386234/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-18959 | third-party-advisory |
| https://vuldb.com/submit/860109 | third-party-advisory |
| https://github.com/ofirbarum923-dot/small-web-vul… | exploitissue-tracking |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-18959",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-06T17:30:11.582249Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-06T17:32:18.463Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:yushine:innoshop:*:*:*:*:*:*:*:*"
],
"modules": [
"Files Endpoint"
],
"product": "InnoShop",
"vendor": "yushine",
"versions": [
{
"status": "affected",
"version": "0.8.0"
},
{
"status": "affected",
"version": "0.8.1"
},
{
"status": "affected",
"version": "0.8.2"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "HackTen (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw has been found in yushine InnoShop up to 0.8.2. Affected by this issue is the function FileManagerController::destroyFiles of the file innopacks/restapi/routes/panel-api.php of the component Files Endpoint. This manipulation causes path traversal. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5.5,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "Path Traversal",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T20:15:10.144Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-386234 | yushine InnoShop Files Endpoint panel-api.php destroyFiles path traversal",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/386234"
},
{
"name": "VDB-386234 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/386234/cti"
},
{
"name": "CVE-2026-18959 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-18959"
},
{
"name": "Submit #860109 | yushine innoshop 0/8/2 Arbitrary File Deletion",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/860109"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/ofirbarum923-dot/small-web-vuln/issues/1"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-05T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-05T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-05T16:10:50.000Z",
"value": "VulDB entry last update"
}
],
"title": "yushine InnoShop Files Endpoint panel-api.php destroyFiles path traversal",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-18959",
"datePublished": "2026-08-05T20:15:10.144Z",
"dateReserved": "2026-08-05T14:05:45.834Z",
"dateUpdated": "2026-08-06T17:32:18.463Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}