CVE-2026-113491

MediumCVSS 6.4/10Last modified Oct 24, 2026

Description

The GeoDirectory WordPress plugin before 2.8.194 does not validate a user-supplied image URL before using it as a local file path when saving a front-end listing, allowing users with Subscriber-level access and above to read files from outside the web root and to delete files on the server, limited to file names that carry an allowed media extension. A disclosed file is re-published at a public URL and its original is deleted as a side effect.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-22

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
UnknownGeoDirectory< 2.8.194

References

Timeline

Published
Oct 24, 2026
Last modified
Oct 24, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-1134925.3The GeoDirectory WordPress plugin before 2.8.194 does not perform status, ownership or password checks when loading listings for one of itsCVE-2026-1134936.8The GeoDirectory WordPress plugin before 2.8.194 does not sanitise and escape some of its map shortcode attributes before outputting them wCVE-2026-1134955.0A flaw was found in cockpit-machines. Red Hat Subscription Management (RHSM) authentication tokens are passed as command-line arguments to bCVE-2026-1134965.0A flaw was found in cockpit-machines. When saving Virtual Network Computing (VNC) console settings, the configured password is passed directCVE-2026-1134997.5The LiteSpeed Cache WordPress plugin before 7.9.2 does not restrict one of its HTML rewriting routines to stylesheet content, so it removes CVE-2026-11356.1A security flaw has been discovered in itsourcecode Society Management System 1.0. This impacts an unknown function of the file /admin/activCVE-2026-1135007.5The LiteSpeed Cache WordPress plugin before 7.9.2 does not limit one of its HTML optimization routines to stylesheet content, so it can deleCVE-2026-1135013.1The LiteSpeed Cache WordPress plugin before 7.9.2 does not perform a capability check on its admin-notice dismissal handler, and the nonce iCVE-2026-1135054.3A flaw has been found in aaPanel up to 8.25.0. Impacted is the function send_file of the file BTPanel/routes/v2.py of the component DownloadCVE-2026-1135069.9A vulnerability has been found in aaPanel up to 8.25.0. The affected element is the function ExecShell of the file class/public/common.py ofCVE-2026-1135075.3A vulnerability was found in aaPanel up to 8.25.0. The impacted element is the function GetClientIp of the file class/public/common.py. The CVE-2026-113515.3The ShinyStat Analytics WordPress plugin before 1.0.17 does not perform any authorization check on one of its REST API endpoints, allowing u