Is there a public PoC exploit available for CVE-2026-18959?

Yes, a public proof-of-concept exploit is available for CVE-2026-18959. Prioritise patching immediately. EPSS: 0.4%.

InnoShop CVE-2026-18959

Q: What is the CVSS score of CVE-2026-18959?

CVE-2026-18959 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-53614 LOW

Path Traversal (CWE-22)

2026-08-05 VulDB

GHSA-cv67-cx47-fp3g

PHP Path Traversal Innoshop

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.4 MEDIUM

Network-reachable API requires low-privilege authentication (PR:L); no scope change; impact limited to file deletion affecting integrity and availability only.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 21:25 vuln.today

Severity Changed

Aug 05, 2026 - 21:22 NVD

MEDIUM LOW

CVSS changed

Aug 05, 2026 - 21:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

CVE Published

Aug 05, 2026 - 20:15 cve.org

LOW 2.1

DescriptionCVE.org

A flaw has been found in yushine InnoShop up to 0.8.2. Affected by this issue is the function FileManagerController::destroyFiles of the file innopacks/restapi/routes/panel-api.php of the component Files Endpoint. This manipulation causes path traversal. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Path traversal in InnoShop versions 0.8.0 through 0.8.2 allows remotely authenticated low-privilege users to delete arbitrary files on the server via the FileManagerController::destroyFiles function exposed through the panel REST API. The affected PHP e-commerce platform by yushine has no vendor-released patch - the vendor did not respond to responsible disclosure - and a public proof-of-concept exploit is available on GitHub. The CVSS 4.0 score of 2.1 reflects limited per-request impact (low integrity, low availability, no confidentiality loss), but the unpatched status combined with public exploit code elevates operational urgency for any deployment.

Technical ContextAI

InnoShop is an open-source PHP e-commerce platform developed by yushine. The vulnerability lies in the FileManagerController::destroyFiles method within innopacks/restapi/routes/panel-api.php, which is a REST API route serving the admin/operator panel. CWE-22 (Path Traversal) indicates that the file path parameter accepted by this endpoint is not canonicalized or validated against an allowed base directory before being passed to a filesystem deletion call. By injecting ../ sequences or other traversal patterns, an attacker with panel API access can escape the intended upload or media directory and reference arbitrary filesystem paths accessible to the web server process. The affected CPE is cpe:2.3:a:yushine:innoshop:*:*:*:*:*:*:*:* across versions 0.8.0, 0.8.1, and 0.8.2 as confirmed by EUVD-2026-53614.

RemediationAI

No vendor-released patch is available at time of analysis - the vendor did not respond to responsible disclosure. Operators should immediately restrict access to the panel REST API (innopacks/restapi/routes/panel-api.php) at the network or web server layer, ensuring it is not accessible from untrusted networks or by untrusted users. Specifically, consider placing the panel API behind IP allowlist controls or HTTP authentication at the reverse proxy level, accepting the trade-off of reduced panel usability from external networks. Review and tighten low-privilege panel user accounts - removing any accounts not strictly necessary - since PR:L means any authenticated panel user is a potential attacker. Monitor the path parameter in API requests to the Files Endpoint for traversal sequences (../, %2e%2e, encoded variants). Track https://vuldb.com/vuln/386234 and the GitHub POC at https://github.com/ofirbarum923-dot/small-web-vuln/issues/1 for patch availability updates.