{"id":"CVE-2026-18959","state":"PUBLISHED","title":"yushine InnoShop Files Endpoint panel-api.php destroyFiles path traversal","description":"A flaw has been found in yushine InnoShop up to 0.8.2. Affected by this issue is the function FileManagerController::destroyFiles of the file innopacks/restapi/routes/panel-api.php of the component Files Endpoint. This manipulation causes path traversal. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","publishedAt":"2026-08-05T20:15:10.144Z","updatedAt":"2026-08-06T17:32:18.463Z","severity":{"score":5.3,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","source":"VulDB"},"assigner":"VulDB","products":["yushine InnoShop"],"affected":[{"vendor":"yushine","product":"InnoShop","versions":[{"version":"0.8.0","status":"affected"},{"version":"0.8.1","status":"affected"},{"version":"0.8.2","status":"affected"}],"cpes":["cpe:2.3:a:yushine:innoshop:*:*:*:*:*:*:*:*"],"modules":["Files Endpoint"]}],"references":["https://vuldb.com/vuln/386234","https://vuldb.com/vuln/386234/cti","https://vuldb.com/cve/CVE-2026-18959","https://vuldb.com/submit/860109","https://github.com/ofirbarum923-dot/small-web-vuln/issues/1"],"weaknesses":["CWE-22"],"ingestedAt":"2026-10-29T20:11:10.572Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/18xxx/CVE-2026-18959.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-18959","state":"PUBLISHED","datePublished":"2026-08-05T20:15:10.144Z","dateUpdated":"2026-08-06T17:32:18.463Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2026-08-05T14:05:45.834Z"},"containers":{"cna":{"title":"yushine InnoShop Files Endpoint panel-api.php destroyFiles path traversal","descriptions":[{"lang":"en","value":"A flaw has been found in yushine InnoShop up to 0.8.2. Affected by this issue is the function FileManagerController::destroyFiles of the file innopacks/restapi/routes/panel-api.php of the component Files Endpoint. This manipulation causes path traversal. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"vendor":"yushine","product":"InnoShop","versions":[{"version":"0.8.0","status":"affected"},{"version":"0.8.1","status":"affected"},{"version":"0.8.2","status":"affected"}],"cpes":["cpe:2.3:a:yushine:innoshop:*:*:*:*:*:*:*:*"],"modules":["Files Endpoint"]}],"references":[{"url":"https://vuldb.com/vuln/386234","name":"VDB-386234 | yushine InnoShop Files Endpoint panel-api.php destroyFiles path traversal","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/386234/cti","name":"VDB-386234 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/cve/CVE-2026-18959","name":"CVE-2026-18959 | CVE Analysis and Report","tags":["third-party-advisory"]},{"url":"https://vuldb.com/submit/860109","name":"Submit #860109 | yushine innoshop 0/8/2 Arbitrary File Deletion","tags":["third-party-advisory"]},{"url":"https://github.com/ofirbarum923-dot/small-web-vuln/issues/1","tags":["exploit","issue-tracking"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.3,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":5.4,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R","baseSeverity":"MEDIUM"}},{"cvssV3_0":{"version":"3.0","baseScore":5.4,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R","baseSeverity":"MEDIUM"}},{"cvssV2_0":{"version":"2.0","baseScore":5.5,"vectorString":"AV:N/AC:L/Au:S/C:N/I:P/A:P/E:POC/RL:ND/RC:UR"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-22","type":"CWE","lang":"en","description":"Path Traversal"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2026-08-05T20:15:10.144Z"},"timeline":[{"time":"2026-08-05T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2026-08-05T02:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2026-08-05T16:10:50.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"HackTen (VulDB User)","type":"reporter"},{"lang":"en","value":"VulDB CNA Team","type":"coordinator"}],"x_generator":["VulDB PVTS v202608"]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-08-06T17:30:11.582249Z","id":"CVE-2026-18959","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-08-06T17:32:18.463Z"}}]}}}