dbcve.org
Path TraversalWeakness · CWE-22

CVE-2026-9506

HIGH · 8.7 CVSS v4.0 Published 2026-06-08
Mitigation only
No fix yet — a mitigation exists. There is no fixed release. A documented workaround reduces exposure in the meantime.
See remediation →
96/100
Remediation priority · Urgent
Remotely reachable No privileges Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
This vulnerability exists in Bagisto due to improper validation of user-supplied input in the ImageCacheController component. An unauthenticated remote attacker could exploit this vulnerability by sending crafted path traversal sequences through the filename parameter to access arbitrary files outside the intended directory on the targeted system. Successful exploitation of this vulnerability could allow an attacker to read arbitrary sensitive files on the targeted system.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

This is a path traversal vulnerability in Bagisto's ImageCacheController where the filename parameter is not properly validated, allowing unauthenticated attackers to use crafted path traversal sequences (such as ../) to escape the intended directory and read arbitrary sensitive files on the system.

MitigationImplement strict input validation on the filename parameter to reject path traversal sequences and ensure files are only accessed within the intended directory boundaries.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Privileges
None
Authentication
X
User interaction
None
Scope
X

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Identify Bagisto installation
    Search for Bagisto by checking for composer.json with 'bagisto/bagisto' in the project root, or look for the 'packages/Webkul' directory structure typical of Bagisto installations
    Affected if Bagisto is not present in the environment
  2. Determine installed Bagisto version
    Check the composer.json file in the project root for the 'version' field under 'bagisto/bagisto', or inspect the VERSION file if present in the root directory
    Affected if The installed version matches or falls within an affected range (if known)
  3. Locate ImageCacheController
    Find the ImageCacheController file in the codebase - typically located under packages/Webkul/Category/src/Http/Controllers/ or similar ImageCache related paths, or search for files containing 'ImageCacheController'
    Affected if The controller exists and is accessible in the codebase
  4. Verify vulnerability access point
    Identify the route mapping to ImageCacheController - check routes/web.php or routes/api.php for routes pointing to the ImageCache functionality, noting the URL pattern and any required parameters
    Affected if An unauthenticated route exists that accepts a filename parameter and passes it to the file reading logic
  5. Test for path traversal capability
    Send a crafted HTTP request to the ImageCache endpoint with a path traversal sequence such as '../../../../etc/passwd' or '../../../../.env' as the filename parameter, and check if the response contains file contents outside the cache directory
    Affected if The application returns content from files outside the intended cache directory

The environment is affected if Bagisto is installed, the ImageCacheController is accessible via an unauthenticated route, and the filename parameter accepts path traversal sequences to read arbitrary files.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

From vendor data
Mitigation available No clean upgrade yet — mitigate in the meantime
Mitigation

Implement strict input validation on the filename parameter to reject path traversal sequences and ensure files are only accessed within the intended directory boundaries.

Have this fixed Scoped from the published advisory
  • Consultation3.0 h
  • Implementation4.0 h
  • Testing3.0 h
  • Review / QA2.0 h
12.0 hours of engineering $2,130
Get help mitigating

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $3,408.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2026-9506 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2026-9506 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data