CVE-2026-18959

Received Received - Intake

Path Traversal in Yushine InnoShop

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: VulDB

Description

A flaw has been found in yushine InnoShop up to 0.8.2. Affected by this issue is the function FileManagerController::destroyFiles of the file innopacks/restapi/routes/panel-api.php of the component Files Endpoint. This manipulation causes path traversal. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-05

Last Modified

2026-08-05

Generated

2026-08-06

AI Q&A

2026-08-06

EPSS Evaluated

N/A

NVD

CVE-2026-18959

EUVD

EUVD-2026-53614

Affected Vendors & Products

Vendor	Product	Version / Range
yushine	innoshop	to 0.8.2 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability is a path traversal flaw in yushine InnoShop up to version 0.8.2. It exists in the FileManagerController::destroyFiles function within the Files Endpoint component. An attacker can remotely exploit this to access unauthorized files by manipulating file paths.

Detection Guidance

Detecting this vulnerability requires checking for path traversal attempts in the Files Endpoint of yushine InnoShop. Monitor logs for unusual file access patterns or requests to the innopacks/restapi/routes/panel-api.php endpoint. Look for sequences like '../' or other path manipulation strings in HTTP requests targeting this component.

Impact Analysis

The impact includes unauthorized access to sensitive files on the server. Attackers may read, modify, or delete files outside intended directories. This could lead to data leaks, system compromise, or further attacks if exploited.

Compliance Impact

This vulnerability could violate compliance requirements like GDPR or HIPAA by exposing sensitive data. Unauthorized file access may lead to data breaches, resulting in legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Immediately update yushine InnoShop to the latest version if available. If no update exists, disable the Files Endpoint in the panel-api.php file or restrict access to the endpoint via firewall rules. Monitor network traffic for exploitation attempts and consider isolating the affected system until a patch is applied.

Hi! I’m here to help you understand CVE-2026-18959. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70