EUVD-2026-109623
GHSA-9f4j-8wcf-9rx4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach EasyImage del.php over network
-
ExploitCraft request manipulating hash argument
-
ExecutionBypass improper privilege check
-
ImpactDelete or tamper with hosted files
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Target is the icret EasyImage (EasyImages2.0) endpoint app/del.php, specifically the 'hash' argument, reachable remotely; per the CVSS vector (PR:N/UI:N/AT:N) exploitation is unauthenticated against a network-exposed instance with no user interaction or special attack requirement. The principal limiting factor is impact scope, not access: confidentiality is unaffected (VC:N) and integrity/availability impact is Low (VI:L/VA:L), i.e. the flaw enables unauthorized file deletion/manipulation rather than data theft or code execution. Affected versions are up to and including 2.8.7; applying the vendor patch (commit b12cb67) is the stated remediation. |
| Impact | This is a moderate-severity, lower-priority issue by the combined signals, not a drop-everything emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remotely reachable, low-complexity flaw needing no privileges or user interaction, but the impact is deliberately bounded: VC:N (no confidentiality loss) with only VI:L/VA:L, yielding a 6.9 base score consistent with improper privilege management (CWE-269) over a file-deletion function rather than code execution. The vuln.today Decision label is 'this_month', not act_now/emergency. It is NOT on CISA KEV and no EPSS score was supplied, so there is no evidence of active or widespread exploitation. The input provides a PoC gist marked 'reference only, not verified as working exploit code', and the CVSS carries E:P (proof-of-concept exploit maturity) - so treat exploitability as plausible but unproven, not weaponized. One data conflict to flag: the supplied commit diff (b12cb67) modifies admin/filer.php and admin/admin.inc.php (file-manager authentication and path hardening), not app/del.php named in the description - so the exact code fix for the del.php 'hash' flaw is not visible in the provided evidence and should be verified against the vendor commit. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends a crafted request to app/del.php manipulating the 'hash' argument to exercise a deletion action they should not be authorized to perform, abusing the improper privilege check to remove or tamper with hosted files. A public PoC reference (gist) exists but is not verified as working exploit code, so a functional exploit may require reconstruction. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no authentication, special timing, or victim interaction is needed, though impact is limited to integrity/availability of files (VC:N). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 26, 2026
Unauthenticated remote manipulation of the 'hash' argument handled by app/del.php in icret EasyImage (EasyImages2.0) through version 2.8.7 permits improper privilege management, letting an attacker perform unauthorized file deletion and manipulation on a network-exposed instance without any credentials or user interaction. Confidentiality is not affected and integrity/availability impact is rated Low, so the practical outcome is destructive file-level tampering rather than data theft or code execution. A public proof-of-concept reference has been published alongside the report; it is a reference only and is not verified as working exploit code, and no confirmed active exploitation has been reported.
RemediationAI
Apply the vendor patch referenced as commit b12cb67d447bcbb67e21c8f011d0f5638229760c (https://github.com/icret/EasyImages2.0/commit/b12cb67d447bcbb67e21c8f011d0f5638229760c); the fix is available from the vendor, but no tagged release number beyond 2.8.7 is confirmed in the supplied data, so deployments pinned to a distribution package should track the upstream repository for the first release containing that commit. The commit's substantive changes - requiring an authenticated admin session before the file manager loads, restricting the file-browser root to the configured image storage directory instead of the site document root, and blocking PHP/PHTML/PHAR extensions from the browser - should be verified as present after deployment. Because exploitation is unauthenticated against a network-exposed instance, interim exposure reduction consists of limiting reachability of the administrative and deletion endpoints to trusted networks or authenticated reverse-proxy front-ends, with the trade-off that public upload/deletion workflows (for example API-driven clients) will need allow-listing to keep functioning. Priority is this_month: the combined signals indicate a moderate-severity, lower-priority issue rather than an emergency.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
EasyImage (repository icret/EasyImages2.0) is a PHP-based image hosting and file management application; the affected code path is the deletion handler app/del.php, where the 'hash' parameter is processed in a way that fails to enforce proper authorization, mapping to CWE-269 (Improper Privilege Management). The supplied sources do not describe the exact trigger mechanism inside del.php, so the precise sequence that bypasses the privilege check is not detailed in the available evidence; what is confirmed is that the argument is remotely reachable and that the assessed vector (AV:N/AC:L/PR:N/UI:N/AT:N) implies no authentication, no user interaction and no special attack precondition. The referenced fix commit b12cb67d447bcbb67e21c8f011d0f5638229760c concentrates on the administrative file manager (admin/filer.php and admin/admin.inc.php): it gates filer.php behind an is_who_login('admin') session check, narrows the file-browser root from the site document root to the configured image storage path, adds an ignore list that hides PHP/PHTML/PHAR and dotfiles, aligns accepted image extensions with the main configuration, removes remote-URL upload and zip/unzip UI actions, and adds HTML/JS context escaping for the user-controlled path parameter in redirects to prevent reflected XSS. These changes indicate the vulnerability class is missing authorization/privilege separation around file operations in the admin-facing PHP code rather than a memory-safety or injection primitive.
Know when Easyimage gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Remote, low-complexity, unauthenticated access to del.php (AV:N/AC:L/PR:N/UI:N); improper privilege management enables file deletion giving I:L/A:L, with no confidentiality exposure (C:N).
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A flaw has been found in icret EasyImage up to 2.8.7. The impacted element is an unknown function of the file app/del.php. Executing a manipulation of the argument hash can lead to improper privilege management. The attack can be launched remotely. The exploit has been published and may be used. This patch is called b12cb67d447bcbb67e21c8f011d0f5638229760c. A patch should be applied to remediate this issue.
Threat Intelligence Overview
NVD
CVE.org
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Exploit-DB