VULNpocalypse

CVE-2026-117566: EasyImages2.0 through 2.8.6 Unauthenticated Path Traversal via down.php, thumb.php and info.php

Advisory generated from the CVE record, CISA, Exploit Observer and VEDAS: what it is, whether it is exploited, who is affected, and how to fix and detect it.

Generated by VEDAS. Scores as of 2026-11-04 15:41 UTC. Rebuilt every few hours from cve-scores, CISA KEV and vedas-signatures. How this works and its limits.

What it is

EasyImages2.0 through 2.8.6 contains an unauthenticated path traversal vulnerability in app/down.php, app/thumb.php and app/info.php that allows reading files outside the upload directory. Attackers can supply ../ sequences in the dw, history or img parameters to read files with allowed upload extensions from the server.

Description quoted from the CVE record (assigned by VulnCheck, published 2026-10-27).

Weakness: Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’)

How it can be exploited

Exploitable over the network with low attack complexity with no special attack requirements needing no privileges and no user interaction. Impact: confidentiality low, integrity none, availability none. CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

CISA assessment (SSVC): CISA has no evidence of exploitation. Automatable: yes. Technical impact: partial.

Public exploit evidence (Exploit Observer)

Exploit Observer found 5 code repositories naming this CVE.

Code repositories that name a CVE are often scanners, copies or fakes, and some are malware. Read the code before running anything.

See all 7 references on Exploit Observer

Live scores

EPSS
0.004
low predicted chance of attack
VEDAS
0.986
strong exploit evidence
On CISA KEV
Not listed
Detection rule
Nuclei · Suricata

Who is affected

ProductAffectedNot affected
icret EasyImages2.0up to and including 2.8.6Not stated

Version ranges exactly as the CVE record states them. “Before X” means X is the first fixed version.

How to fix it

Vendor guidance:

How to detect it

Nuclei template (active check)

EasyImages - Unauthenticated Path Traversal

EasyImages2.0 through 2.8.6 contains an unauthenticated path traversal in app/down.php, app/thumb.php and app/info.php. The `dw`/`history` parameters of app/down.php are prefixed with `../` and passed to is_file()/readfile() without any containment check, so `../` sequences let a remote attacker resolve files outside the upload directory. Probing a traversal path that points at an existing out-of-tree file (for example /etc/passwd, which has no allowed upload extension) makes the download handler reach its extension-filter branch, confirming the traversal escaped the web root on an unpatched instance.

Name and description quoted from the template, written by VEDAS.

The template sends 1 request (GET /app/down.php?dw=../../../../../../../../etc/passwd); it decides using status, word matchers. Severity in the template: high. Marked as not yet verified against a live vulnerable target.

Run it against a host you own or are authorised to test:

bash
nuclei -u https://your-host -t CVE-2026-117566.yaml
Show the template (39 lines)
yaml
id: CVE-2026-117566

info:
  name: "EasyImages - Unauthenticated Path Traversal"
  author: vedas-arpsyndicate
  severity: high
  description: |
    EasyImages2.0 through 2.8.6 contains an unauthenticated path traversal in app/down.php, app/thumb.php
    and app/info.php. The `dw`/`history` parameters of app/down.php are prefixed with `../` and passed to
    is_file()/readfile() without any containment check, so `../` sequences let a remote attacker resolve
    files outside the upload directory. Probing a traversal path that points at an existing out-of-tree file
    (for example /etc/passwd, which has no allowed upload extension) makes the download handler reach its
    extension-filter branch, confirming the traversal escaped the web root on an unpatched instance.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2026-117566&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=easyimages&match=exact
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2026-117566
    cwe-id: CWE-22
  metadata:
    verified: false
  tags: cve,cve2026,easyimages,lfi
http:
  - raw:
      - |
        GET /app/down.php?dw=../../../../../../../../etc/passwd HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "Downfile Type Error"
      - type: status
        status:
          - 200

CVE-2026-117566.yaml on GitHub

Suricata rules (network detection)

1 rule that alert on traffic matching this exploit: VEDAS CVE-2026-117566 EasyImages - Unauthenticated Path Traversal. Add them to your Suricata rule set and reload.

Show the rules
suricata
alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"VEDAS CVE-2026-117566 EasyImages - Unauthenticated Path Traversal"; flow:established,to_server; http.uri; content:"/app/down.php"; nocase; fast_pattern; pcre:"/[?&](?:dw|history)=[^& ]*\.\.(?:\x2f|%2f|%5c|\x5c)/i"; classtype:web-application-attack; reference:cve,CVE-2026-117566; reference:url,https://www.exploit.observer/?keyword=CVE-2026-117566&match=exact; reference:url,https://subdomain.center/?engine=ammonites&keyword=easyimages&match=exact; sid:1089800; rev:1;)

CVE-2026-117566.rules on GitHub

References

Vendor advisories and patches

Technical analysis and advisories

Other references

Other databases

Where this comes from

This advisory is generated automatically by VEDAS from: CVE.org record, cve-scores (EPSS and VEDAS), Exploit Observer, vedas-signatures. Text in quotes is reproduced from the source; everything else is a fixed template filled with source fields. Nothing here is written by a language model. Check the vendor advisory before acting, and read how VEDAS and Exploit Observer work, and their limits.

Supporting partners

Feasible SecurityAskealGoTrust