CVE-2026-78394

Name of the Vulnerable Software and Affected Versions Link Library versions prior to 7.9.6

Description Insufficient sanitization of a user-supplied destination folder occurs when writing a generated image to disk. This allows users with the Contributor role and above to create directories and write or overwrite image files in any location accessible to the web server, including areas outside the site's document root. This issue is triggered via the filepath parameter. Because the written file name is always numeric with a fixed image extension, executable code cannot be uploaded through this method.

Recommendations Update Link Library to version 7.9.6 or later.