CVE-2026-18959

Name of the Vulnerable Software and Affected Versions yushine InnoShop versions prior to 0.8.2

Description A path traversal flaw exists in the Files Endpoint component. This issue occurs within the FileManagerController::destroyFiles() function located in the innopacks/restapi/routes/panel-api.php file. A remote attacker can exploit this to access or manipulate files outside the intended directory. Path traversal is a technique used to access files and directories that are stored outside the web root folder.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the FileManagerController::destroyFiles() function to minimize the risk of exploitation.