InnoShop CVE-2026-108591

Exploitation requires an authenticated administrator account that holds the specific files_create permission (PR:H) and access to the AI Core MCP file_upload tool. The concrete trigger is supplying a file:// or php:// stream wrapper as the tool's 'source' argument, which is then passed to file_get_contents() and written to the public media disk. Limiting factors: the attacker must already possess high-privilege admin credentials and the MCP/AI Core functionality must be enabled and reachable; this is not exploitable by unauthenticated or low-privileged users, and the primary realistic threat model is a malicious or compromised admin escalating to theft of application secrets and database credentials.

This is a genuinely moderate, not high, priority. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N) scores 5.9 and the signals are internally consistent: network-reachable but gated behind high privileges (PR:H) - an authenticated administrator already holding the files_create permission - with attack requirements present (AT:P) reflecting the need to invoke the AI Core MCP file_upload tool. The impact is confidentiality-only (VC:H, VI:N, VA:N), matching a file-disclosure primitive that reads the .env (APP_KEY, DB credentials) but does not directly modify or deny service. No KEV listing and no explicit POC flag were provided in the input, so exploitation status is 'no public exploit identified at time of analysis'; however, a detailed third-party technical writeup (hackmd) and the exact vulnerable source lines are referenced, which lowers the barrier to weaponization even though that is not the same as active exploitation. EPSS was not supplied - treat exploitation probability as unknown rather than low. The dominant limiting factor is the PR:H prerequisite: the attacker must already be a trusted admin, which reframes this primarily as a privilege-boundary/credential-exposure issue (a malicious or compromised admin account escalating to full DB credential theft) rather than a mass-exploitable remote flaw.

An attacker who controls an administrator account with the files_create permission (or who has phished/compromised such an account) invokes the AI Core MCP file_upload tool and sets its 'source' argument to a file:// or php:// stream wrapper. file_get_contents() then resolves the wrapper and the server writes the retrieved contents - such as the application .env - onto the public media disk, where the attacker fetches APP_KEY and database credentials over HTTP. The vulnerable code paths and a technical writeup are publicly referenced, but no packaged exploit was flagged in the input.