CVE-2026-18959
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk45th percentile - higher than 45% of all known CVEs
Summary
InnoShop up to version 0.8.2 contains a path traversal vulnerability in the FileManagerController::destroyFiles function in the Files Endpoint component. The attack can be initiated remotely, and an exploit has been published.
Risk Assessment
An attacker can access files outside the intended directory, potentially leading to disclosure of sensitive data or modification.
Recommendation
Apply available patches or restrict access to the Files Endpoint component if possible.
Other vulnerabilities in InnoShop
See all- CVE-2026-108591Medium
InnoShop 0.9.2 contains a local file disclosure vulnerability that allows authenticated administrators with files_create permission to read server files by abusing the AI Core MCP file_upload tool's source argument. Attackers can supply file:// or php:// stream wrappers passed to file_get_contents(), storing contents on the public media disk to expose the .env file with APP_KEY and database credentials.
- CVE-2026-39250High
Innoshop 0.6.0 has an authorization vulnerability. After logging into the frontend, an attacker can directly access backend application interfaces, leading to further dangerous operations.
Original NVD description (English source)
A flaw has been found in yushine InnoShop up to 0.8.2. Affected by this issue is the function FileManagerController::destroyFiles of the file innopacks/restapi/routes/panel-api.php of the component Files Endpoint. This manipulation causes path traversal. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS