CVE-2026-82921

Name of the Vulnerable Software and Affected Versions ShopEx ECShop versions prior to 2.5.2

Description A weakness in the check img type() function within the admin/pack.php file allows for unrestricted file upload. A remote attacker can exploit this by manipulating the pack img argument.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the admin/pack.php file or disable the check img type() function to minimize the risk of exploitation.