EUVD-2026-85789
GHSA-prgg-jw4q-hhmp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed ShopXO UEditor endpoint
-
DeliverySend request to config/ueditor.php
-
ExploitManipulate path_type parameter
-
ExecutionTraverse outside intended directory
-
ImpactRead or write files beyond webroot
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network access to a ShopXO instance (version up to 2.2.7) whose UEditor upload interface at config/ueditor.php is reachable, with the attacker supplying a manipulated path_type argument. Per the CVSS vector (PR:N/UI:N) no authentication or user interaction is needed, so default-exposed deployments are directly at risk. The main limiting factors are reachability of the UEditor endpoint (it must be exposed/enabled) and that no official patch exists yet, meaning defenders must rely on access restrictions or input filtering; realistic impact is bounded to Low confidentiality/integrity effects rather than full system compromise based on available data. |
| Impact | This is a moderate, credible issue rather than a top-tier emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes remote, low-complexity, unauthenticated exploitation, and the vendor-assigned 6.9 reflects that path traversal in an upload interface can affect confidentiality, integrity, and availability at Low each (VC:L/VI:L/VA:L). Public exploit code exists (VulDB, referenced via the Gitee issue), which raises practical risk, but the SSVC-relevant exploitation maturity is only Proof-of-Concept (E:P) - POC availability is NOT the same as confirmed active exploitation. There is no EPSS score and no CISA KEV listing in the input, so there is no signal of mass or targeted in-the-wild use at this time. The strongest risk driver here is the combination of no-auth network reachability plus a public POC against an unpatched product (vendor was notified via an issue report and has not responded). Net: a real, actionable vulnerability that warrants prompt remediation for anyone running ShopXO, but the Low sub-impacts and absence of KEV/EPSS keep it below critical-priority triage. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends a crafted request to config/ueditor.php (the UEditor upload interface) and manipulates the path_type argument to traverse outside the intended directory, reaching files or upload locations the application should not expose. Public proof-of-concept exploitation is documented in the vendor's Gitee issue tracker (issue IK4LPH), lowering the skill barrier. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no credentials or victim interaction are needed against a reachable, unpatched ShopXO instance. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 24, 2026
Path traversal in the UEditor upload interface of ShopXO (yhx070424/shopxo) through version 2.2.7 lets remote attackers manipulate the path_type argument in config/ueditor.php to write or access files outside the intended upload directory. The CVSS v4.0 vector (AV:N/AC:L/PR:N/UI:N, E:P) indicates the attack is network-reachable with no authentication or user interaction required, and publicly available exploit code exists; there is no confirmed evidence of active exploitation (not listed in CISA KEV). The vendor was notified via an issue report but has not responded, so no vendor-released patch has been identified at time of analysis, and the realistic impact is bounded to Low confidentiality and integrity effects rather than full system compromise.
RemediationAI
No vendor-released patch identified at time of analysis: ShopXO's maintainer was notified through the Gitee issue tracker (https://gitee.com/yhx070424/shopxo/issues/IK4LPH) and has not responded, so upgrading is not currently an option and the fixed version is unknown. Until a patched release appears, the most effective control is to remove external exposure of the UEditor handler - block or deny direct requests to config/ueditor.php and the UEditor upload action at the reverse proxy/WAF (for example, return 403 for requests whose path matches config/ueditor.php or that carry a path_type parameter containing '..', '/', or backslash sequences). The trade-off is that backend editors lose rich-text image/file uploads until the endpoint is re-enabled, which may interrupt content management workflows. Additional compensating measures, each with side effects: restrict the endpoint to authenticated administrator sessions and trusted source IP ranges, which does not fix the flaw but removes the unauthenticated PR:N exposure and may break legitimate admin uploads from remote offices; run the PHP-FPM/webserver process under a low-privilege OS account with no write access outside the uploads directory and with open_basedir and disable_functions constraints, limiting traversal depth at the cost of possible application errors if ShopXO writes to other paths; and place upload directories on a non-executable mount (noexec, plus a webserver rule denying script execution in upload folders) to blunt follow-on effects if a file is written, at the cost of reconfiguring existing hosting. Monitoring for anomalous path_type values and unexpected file creation in web-accessible directories is recommended for detection while exposure persists. Cross-reference the vendor repository https://gitee.com/yhx070424/shopxo/ and the VulDB entry https://vuldb.com/vuln/409201 for later patch announcements.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ShopXO is an open-source PHP e-commerce platform whose administrative backend bundles the UEditor rich-text editor as its content upload component. The exposed interface is driven by config/ueditor.php, which processes upload requests and accepts a path_type parameter that is intended to select among predefined storage locations (for example image, file, or video directories). The code applies insufficient canonicalization and validation of that parameter before joining it to the base upload path, so an attacker can inject traversal sequences (../) or absolute-path fragments to escape the intended directory tree. This is the classic CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) class, and because the affected component is a PHP upload handler, the primary consequences are unauthorized file read/write primitives within the web server's filesystem permissions rather than direct code execution. The CPE identifier cpe:2.3:a:yhx070424:shopxo:*:*:*:*:*:*:*:* confirms the whole product line is treated as affected, and the reported ceiling is version 2.2.7.
Know when Shopxo gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Remote unauthenticated path traversal with low-complexity attack; limited file read (C:L) and possible constrained write via the upload interface (I:L), no clear availability impact.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was detected in yhx070424 ShopXO up to 2.2.7. Affected by this vulnerability is an unknown functionality of the file config/ueditor.php of the component Ueditor Upload Interface. The manipulation of the argument path_type results in path traversal. It is possible to launch the attack remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
ShopXO 6.4.0 is vulnerable to File Upload in ThemeDataService.php. Rated critical severity (CVSS 9.8), this vulnerabilit
ShopXO v2.2.5 and below was discovered to contain a system re-install vulnerability via the Add function in app/install/
An issue was discovered in ShopXO 1.2.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,
An issue was discovered in ShopXO 1.2.0. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no
shopxo v6.4.0 has a ssrf/xss vulnerability in multiple places. Rated medium severity (CVSS 6.5), this vulnerability is r
ShopXO v6.4.0 is vulnerable to Server-Side Request Forgery (SSRF) in Email Settings. Rated medium severity (CVSS 6.3), t
ShopXO v6.4.0 is vulnerable to Server-Side Request Forgery (SSRF) via image upload function. Rated medium severity (CVSS
A remote command execution vulnerability in shopxo 1.9.3 allows an attacker to upload malicious code generated by phar w
Unauthenticated remote access to ShopXO's Scheduled Task (Crontab) API endpoint in versions up to 6.7.1 allows any netwo
A vulnerability was found in ShopXO up to 6.1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploi
A vulnerability was found in ShopXO up to 6.4.0. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploi
ShopXO v1.8.1 has a command execution vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
Exploit-DB