CVE-2026-36767 — A path traversal vulnerability in the /content/images/add endpoint of shopizer v3.2.5 allows attackers write arbitrary files to any writeable path via a crafted POST request

Back Back to CVE browser

CRITICAL

A path traversal vulnerability in the /content/images/add endpoint of shopizer v3.2.5 allows attackers write arbitrary files to any writeable path via a crafted POST request

Published Apr 30, 2026

10.0

CRITICAL

CVSS 3.1

EPSS 0.64%

Description

A path traversal vulnerability in the /content/images/add endpoint of shopizer v3.2.5 allows attackers write arbitrary files to any writeable path via a crafted POST request.

Affected products

Remediation

No remediation recorded yet.

Metrics

0.64% 0.00641

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 3, 2026.

EPSS probability 0.00641

Score over time

May–Oct 2026

EPSS v4
EPSS v5

Percentile over time

EPSS v4
EPSS v5

Table of values (3 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 3, 2026	0.64% (0.00641)	48.92th	v5 (v2026.06.15)
Jun 15, 2026	0.41% (0.00412)	32.60th	v5 (v2026.06.15)
May 1, 2026	0.06% (0.00063)	19.48th	v4 (v2025.03.14)

Weaknesses (1)

CWE-22

Path Traversal

References (4)

Link	Providers	Tags
https://github.com/advisories/GHSA-f5w4-7ccj-5m75		Advisory
https://github.com/shopizer-ecommerce/shopizer
https://github.com/shopizer-ecommerce/shopizer/issues/1091		exploit
https://nvd.nist.gov/vuln/detail/CVE-2026-36767