CVE-2026-96898

Name of the Vulnerable Software and Affected Versions ShopXO versions prior to 2.2.8

Description A path traversal issue exists in the Ueditor Upload Interface component within the config/ueditor.php file. A remote attacker can exploit this by manipulating the path type argument, allowing them to access files or directories outside the intended folder.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.