CVE-2026-9506 - Path Traversal Vulnerability in Bagisto

Back Back to CVE browser

HIGH

Path Traversal Vulnerability in Bagisto

Published Jun 8, 2026

8.7

HIGH

CVSS 4.0

EPSS 1.81%

Description

This vulnerability exists in Bagisto due to improper validation of user-supplied input in the ImageCacheController component. An unauthenticated remote attacker could exploit this vulnerability by sending crafted path traversal sequences through the filename parameter to access arbitrary files outside the intended directory on the targeted system.

Successful exploitation of this vulnerability could allow an attacker to read arbitrary sensitive files on the targeted system.

Affected products

Vendor Webkul Product Bagisto Default
unaffected
- Version
  version v2.4.1
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Webkul

Bagisto

unaffected

Version	Status	Constraints
version v2.4.1	affected	-

Remediation

Vendor solution

Upgrade Bagisto to the patched version v2.4.2 or later.

https://github.com/bagisto/bagisto/tree/v2.4.2

Weaknesses (1)

CWE-22

Path Traversal

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-35036
Advisory
https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0292
third-party-advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-35036		Advisory
https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0292		third-party-advisory