An arbitrary file upload vulnerability in the /admin/manager.php component of EasyImages 2.0 v2.8.6 and below allows attackers to execute arbitrary code via uploading a crafted PHP file.
Fix
Nothing published yet: no patch, vendor advisory or mitigation reference on NVD, no vendor advisory in the News for this CVE, not in CISA's KEV, no fixed package version. BaselineWatch does not guess at one.
Change history 1
- First seenCVSS 8.8 · easyimages2.0_projectNVD modified 2026-10-14 21:10
Affected (CPE criteria) 1
cpe:2.3:a:easyimages2.0_project:easyimages2.0:*:*:*:*:*:*:*:*
References 2
- https://congsec.cn/?id=20251102153546-i712jss Exploit, Third Party Advisory
- https://gist.github.com/CongSec/cd3d3ee57b8e6f83c7038e2263c15120 Exploit, Third Party Advisory