EasyImages2.0 CVE-2026-117566

No authentication, user interaction, or special configuration is required: a single crafted HTTP request to app/down.php, app/thumb.php, or app/info.php with '../' sequences in the dw, history, or img parameter triggers the traversal against a default EasyImages2.0 (≤2.8.6) install. The primary LIMITING factor is that the application only returns files whose extension is in the allowed upload-extension set, so disclosure is restricted to files bearing an allowed image extension rather than arbitrary server files; deployment must also expose these PHP endpoints to the attacker (direct or proxied web access).

This is a medium-severity, unauthenticated remote information-disclosure flaw, and the signals are internally consistent rather than conflicting. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms network-reachable, low-complexity, no-authentication, no-user-interaction exploitation, which matches the description's 'unauthenticated path traversal'. However, impact is deliberately bounded: VC:L with VI:N/VA:N, and the description states that only files 'with allowed upload extensions' can be read - so this is NOT arbitrary file disclosure of sensitive OS files like /etc/passwd or application secrets unless those happen to carry an allowed image extension. That extension allowlist is the single most important risk-limiting factor and is why the score lands at 6.9 (medium) rather than critical. No EPSS score was provided, so statistical exploitation probability cannot be weighed; the CVE is NOT in CISA KEV, so there is no evidence of active exploitation. The vuln.today decision label is 'this_month' (not act_now/emergency), aligning with a real-but-non-emergency priority. A PoC/report reference exists (GitHub issue #286 and a VulnCheck advisory) but the input does not confirm it as working weaponized exploit code. Net: a genuine, easy-to-exploit but low-impact disclosure bug on a niche self-hosted product - worth patching this cycle, not a drop-everything incident.

A remote attacker with no account sends a crafted HTTP request to app/down.php (or thumb.php/info.php) placing '../' sequences in the dw, history, or img parameter, causing the application to resolve a path outside the intended upload directory and return a file that carries an allowed upload extension. A public PoC reference exists (GitHub issue #286 / VulnCheck advisory); it is not verified as working exploit code. Because exploitation needs only a single unauthenticated request against a default install, it is trivial to automate, though the extension allowlist limits what can actually be exfiltrated.