CVE-2026-25397
Path Traversal in File Uploader for WooCommerce
Publication date: 2026-03-25
Last updated on: 2026-04-28
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| snowray_software | file_uploader_for_woocommerce | to 1.0.4 (inc) |
| snowray_software | file_uploader_for_woocommerce | From 1.0.0 (inc) to 1.0.4 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-35 | The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot slash) sequences that can resolve to a location that is outside of that directory. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-25397 is a high-priority Path Traversal vulnerability in the WordPress File Uploader for WooCommerce Plugin versions up to and including 1.0.4.
This flaw allows unauthenticated attackers to exploit the plugin by traversing directories on the server, potentially accessing unauthorized files.
It is classified under OWASP Top 10 A1: Broken Access Control, indicating a serious security weakness related to improper access restrictions.
How can this vulnerability impact me? :
This vulnerability poses a significant security risk with a CVSS severity score of 7.5, meaning it is likely to be exploited in widespread attacks.
Exploitation can lead to unauthorized access to sensitive files on the server, potentially exposing confidential data or allowing further compromise of the website.
Since the vulnerability can be exploited by unauthenticated attackers, it increases the risk of data breaches and unauthorized system access.
No official patch is currently available, so users must rely on mitigation rules or seek assistance to reduce the risk until an update is released.
What immediate steps should I take to mitigate this vulnerability?
The CVE-2026-25397 vulnerability affects the File Uploader for WooCommerce Plugin versions up to and including 1.0.4 and allows unauthenticated attackers to perform path traversal attacks.
Since no official patch is currently available, immediate mitigation involves applying the Patchstack mitigation rule that blocks attacks exploiting this flaw.
- Apply the Patchstack mitigation rule to block exploitation attempts.
- Monitor for updates and update the plugin immediately once an official patch is released.
- Seek assistance from your hosting provider or web developer to implement additional security measures.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The CVE-2026-25397 vulnerability is a high-priority Path Traversal flaw that allows unauthenticated attackers to access unauthorized files on the server. Such unauthorized access can lead to exposure of sensitive data, which may impact compliance with common standards and regulations like GDPR and HIPAA that require protection of personal and sensitive information.
Because this vulnerability enables broken access control and potential data breaches, organizations using the affected plugin could face increased risk of non-compliance with data protection regulations until the vulnerability is patched or mitigated.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
The CVE-2026-25397 vulnerability is a Path Traversal flaw in the File Uploader for WooCommerce plugin that allows attackers to access unauthorized files by exploiting directory traversal sequences like '.../...//'.
To detect attempts to exploit this vulnerability on your system or network, you should monitor web server logs for suspicious requests containing directory traversal patterns such as '../' or variations like '.../...//'.
Example commands to search for such patterns in your web server access logs (assuming a Linux environment) include:
- grep -E '\.\./|\.\.\/\.\.\/' /var/log/apache2/access.log
- grep -i 'file-uploader-for-woocommerce' /var/log/apache2/access.log | grep '\.\./'
Additionally, consider using intrusion detection systems or web application firewalls that can detect and block directory traversal attempts.
Since no official patch is currently available, applying mitigation rules from security providers like Patchstack can help block exploitation attempts.