PlatformPlansPartners
Resources
ToolsBlogDocs
Labs
CVE ForecastOpservantAll Research →
Sign Up →
CVE

CVE-2026-9506

8.7
CVSShigh
Exploitable remotely over the internet · no authentication required.
Description

This vulnerability exists in Bagisto due to improper validation of user-supplied input in the ImageCacheController component. An unauthenticated remote attacker could exploit this vulnerability by sending crafted path traversal sequences through the filename parameter to access arbitrary files outside the intended directory on the targeted system. Successful exploitation of this vulnerability could allow an attacker to read arbitrary sensitive files on the targeted system.

Attack Vector
Network
Privileges Req.
None
User Interaction
None
bagisto
Updated Sep 18, 2026View on NVD →
S4E scanner

Bagisto <= 2.4.1 - Unauthenticated Arbitrary File Read

Bagisto through 2.4.1 is vulnerable to unauthenticated path traversal in the ImageCache controller. The `original` image-cache route (/cache/original/{filename}) passes the user-supplied filename to getImagePath() without any '..' filtering or realpath containment, allowing a remote unauthenticated attacker to read files outside the intended public image directories (upload/images) - for example the application's composer.json, artisan and other source files. References: https://github.com/advisories/GHSA-qhcg-rw5x-vg94 https://nvd.nist.gov/vuln/detail/CVE-2026-9506 https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0292 https://www.ionix.io/threat-center/cve-2026-9506/ Remediation: Fixed in 2.4.2, which adds realpath() containment and '../' sanitisation.

Used 2.1k times · url

CVE history: bagisto

Predict next CVE date with AI

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →