What is the CVSS score of EUVD-2026-28806?

EUVD-2026-28806 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.1%.

Is there a patch available for EUVD-2026-28806?

Yes, a patch is available for EUVD-2026-28806. Update the affected software to the latest version immediately.

novaGallery EUVD-2026-28806

| CVE-2026-42028 MEDIUM

Path Traversal (CWE-22)

2026-05-08 GitHub_M

PHP Path Traversal

5.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

May 08, 2026 - 18:03 EUVD

Source Code Evidence Fetched

May 08, 2026 - 17:01 vuln.today

Analysis Generated

May 08, 2026 - 17:01 vuln.today

CVE Published

May 08, 2026 - 15:54 nvd

MEDIUM 5.3

DescriptionGitHub Advisory

novaGallery is a php image gallery. Prior to version 2.1.1, a path traversal vulnerability has been identified in novaGallery. This allows unauthenticated users to read image files outside the intended gallery root directory. This issue has been patched in version 2.1.1.

AnalysisAI

Path traversal vulnerability in novaGallery prior to version 2.1.1 allows unauthenticated remote attackers to read arbitrary image files outside the intended gallery root directory via crafted album or image parameters. The vulnerability has low real-world impact (confidentiality only, CVSS 5.3) but affects all unpatched installations since exploitation requires no authentication, user interaction, or special configuration. Vendor-released patch version 2.1.1 is available.

Technical ContextAI

novaGallery is a PHP-based image gallery application that manages image files through parameter-based album and image selection. The vulnerability stems from insufficient input validation and path boundary checking in the image retrieval functions (cachedImage and album methods in App.php). CWE-22 (Path Traversal) occurs when user-supplied path components (album and image parameters) are not properly validated before being used to construct filesystem paths. The fix adds three protective mechanisms: isSafeRelativePath() validates relative path syntax by rejecting null bytes, parent directory references (..), backslashes, and absolute paths; isPathWithinImagesDir() uses realpath() to resolve symbolic links and relative path traversal, then verifies the resolved path stays within the designated IMAGES_DIR using string comparison; and imageNotFound() consistently handles invalid access attempts. This defense-in-depth approach prevents both directory traversal sequences and symlink-based escapes from the gallery root.

RemediationAI

Upgrade to novaGallery version 2.1.1 or later immediately; patched release is available at https://github.com/novafacile/novagallery/releases/tag/v2.1.1. The patch implements strict path validation via isSafeRelativePath() (rejecting relative path sequences, null bytes, backslashes, and absolute paths) and isPathWithinImagesDir() (validating resolved paths remain within the designated gallery directory). If immediate upgrade is not feasible, as a temporary workaround restrict access to the novaGallery installation via web server configuration (nginx/Apache access controls, WAF rules) to trusted networks only, though this does not remediate the underlying vulnerability. Additionally, audit web server logs for suspicious image parameter patterns containing ../, encoded traversal sequences (%2e%2e), or requests for non-image file types to detect exploitation attempts prior to patching.