CVE-2026-108591

Katalog CVE

CVSS 4.4 · Medium EPSS 0,27%

Kerentanan External Control of File Name or Path. Skor CVSS 3.1 4.4 (Medium) menurut vulncheck.com.

Deskripsi (NVD)

InnoShop 0.9.2 contains a local file disclosure vulnerability that allows authenticated administrators with files_create permission to read server files by abusing the AI Core MCP file_upload tool's source argument. Attackers can supply file:// or php:// stream wrappers passed to file_get_contents(), storing contents on the public media disk to expose the .env file with APP_KEY and database credentials.

Rincian

Terbit di NVD

10 Oktober 2026

Terakhir diubah

10 Oktober 2026

Status NVD

Received

CVSS 3.1

4.4 (Medium), sumber vulncheck.com
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-73: External Control of File Name or Path

EPSS (30 hari)

0,27% peluang dieksploitasi; lebih tinggi dari 17,7% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/innocommerce/innoshop
• https://github.com/innocommerce/innoshop/blob/6af6a9744414d10d2f5aab516ed0b6c3045a2848/innopacks/aicore/src/To...
• https://github.com/innocommerce/innoshop/blob/6af6a9744414d10d2f5aab516ed0b6c3045a2848/innopacks/restapi/src/S...
• https://hackmd.io/@haind/innoshop-mcp-local-file-read
• https://www.vulncheck.com/advisories/innoshop-0.9.2-local-file-disclosure-via-ai-core-mcp-file-upload-tool