Hackten

**Name of the Vulnerable Software and Affected Versions** yushine InnoShop versions prior to 0.8.2 **Description** A path traversal flaw exists in the Files Endpoint component. This issue occurs within the `FileManagerController::destroyFiles()` function located in the `innopacks/restapi/routes/panel-api.php` file. A remote attacker can exploit this to access or manipulate files outside the intended directory. Path traversal is a technique used to access files and directories that are stored outside the web root folder. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the `FileManagerController::destroyFiles()` function to minimize the risk of exploitation.