CVE-2026-9506 Path Traversal Vulnerability in Bagisto
Unauthenticated attackers can read arbitrary sensitive files on the server via path traversal in Bagisto's ImageCacheController.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-9506?
CVE-2026-9506 is a high-severity path traversal vulnerability in Webkul Bagisto, published on 8 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
This vulnerability exists in Bagisto due to improper validation of user-supplied input in the ImageCacheController component. An unauthenticated remote attacker could exploit this vulnerability by sending crafted path traversal sequences through the filename parameter to access arbitrary files outside the intended directory on the targeted system.
Successful exploitation of this vulnerability could allow an attacker to read arbitrary sensitive files on the targeted system.
Weakness: CWE-22
Which versions are affected by CVE-2026-9506?
How do I fix CVE-2026-9506?
No fix has been published for CVE-2026-9506 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-9506 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-9506 exists.
Public exploit code: 1 Nuclei template.
Sources
Also known as GHSA-qhcg-rw5x-vg94.