CVE-2026-96898

HighCVSS 7.3/10Last modified Sep 24, 2026

Description

A vulnerability was detected in yhx070424 ShopXO up to 2.2.7. Affected by this vulnerability is an unknown functionality of the file config/ueditor.php of the component Ueditor Upload Interface. The manipulation of the argument path_type results in path traversal. It is possible to launch the attack remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Sep 24, 2026
Last modified: Sep 24, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-968996.8The Optima Express IDX WordPress plugin before 8.7.6 does not properly neutralise a script value submitted through one of its REST endpoints CVE-2026-96907.5Unauthenticated Arbitrary File Download in WP Media folder Addon <= 4.0.1 versions.CVE-2026-969005.3The Cart Abandonment Recovery for WooCommerce WordPress plugin before 2.1.4 does not verify ownership of the email address used to select a CVE-2026-969013.7The Cart Abandonment Recovery for WooCommerce WordPress plugin before 2.2.0 does not verify the integrity of its cart-recovery token before CVE-2026-969025.3The Easy Property Listings WordPress plugin before 3.5.28 does not restrict which listing fields it adds to the public REST API output, allo CVE-2026-969034.3The Easy Property Listings WordPress plugin before 3.5.27 does not perform authorisation checks on several of its contact-management read AJ CVE-2026-969045.3The AWP Classifieds WordPress plugin before 4.4.9 does not verify that a request is authorised to view a listing when a payment transaction CVE-2026-969099.8Heap-based buffer overflow in Windows BitLocker allows an unauthorized attacker to execute code over a network.CVE-2026-96919.8Unauthenticated PHP Object Injection in Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.1.1 versions CVE-2026-969105.5Untrusted pointer dereference in Microsoft Windows Search Component allows an authorized attacker to disclose information locally.CVE-2026-969117.8Improper link resolution before file access ('link following') in Microsoft Windows Search Component allows an authorized attacker to elevat CVE-2026-969127.8Use after free in Windows Client License Service allows an authorized attacker to elevate privileges locally.