CVE-2026-18959

MediumCVSS 5.4/10Last modified Oct 23, 2026

Description

A flaw has been found in yushine InnoShop up to 0.8.2. Affected by this issue is the function FileManagerController::destroyFiles of the file innopacks/restapi/routes/panel-api.php of the component Files Endpoint. This manipulation causes path traversal. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Aug 5, 2026
Last modified: Oct 23, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-18966.3A vulnerability has been found in WeKan up to 8.20. Affected by this vulnerability is the function ComprehensiveBoardMigration of the file s CVE-2026-189605.4The Block User Account WordPress plugin before 2.0.1 does not enforce its account block on every authentication path, allowing a blocked use CVE-2026-189618.1The Social Login, Passkeys, Magic Link & Email OTP – Passwordless Login by VentraConnect plugin for WordPress is vulnerable to Authenticatio CVE-2026-189624.3The WP Photo Album Plus WordPress plugin before 9.2.09.002 does not check that the current user is allowed to upload into the album they tar CVE-2026-189639.1A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access manageme CVE-2026-189646.1The Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty plugin for WordPress is CVE-2026-189658.8PayRange API is missing proper authorization on management endpoints, which allows verbose details of every device on the PayRange network t CVE-2026-189678.1A flaw was found in the SAML broker component of Keycloak, an identity and access management solution. When configured as a SAML broker usin CVE-2026-189684.3A security vulnerability has been detected in ttttonyhe OBlog up to 3ca6a45a2fcc81f6086751d8af124658720e8f8f. This issue affects some unknow CVE-2026-189697.3A vulnerability was detected in Rongzhitong Visual Integrated Command and Dispatch Platform up to 20260617. Impacted is an unknown function CVE-2026-18974.3A vulnerability was found in WeKan up to 8.20. Affected by this issue is some unknown functionality of the file server/methods/positionHisto CVE-2026-189707.3A flaw has been found in Rongzhitong Visual Integrated Command and Dispatch Platform up to 20260617. The affected element is an unknown func