CVE-2026-9506: Path Traversal Vulnerability in Bagisto

Synopsis

A path traversal vulnerability exists in the ImageCacheController component of Bagisto (version v2.4.1). The flaw is reachable over the network without any authentication, and an attacker exploits it by sending crafted filename parameters containing directory traversal sequences (for example, "../../") to step outside the intended file directory. Successful exploitation allows the attacker to read arbitrary files on the host system, including configuration files, credentials, and other sensitive data. HarborGuard tracks the upstream advisory and will make a patched-image rebuild available as soon as a fix version is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network; an attacker must be able to send HTTP requests to the Bagisto service to exploit this flaw.

• AuthenticationNot required

  No account or session token is needed; the ImageCacheController endpoint accepts unauthenticated requests.

• Victim interactionNot required

  The attacker sends a crafted request directly to the server; no user action or social engineering is required.

• Attack complexityDetail

  Exploitation is straightforward and condition-free; no race condition, specific memory layout, or environmental prerequisite is needed beyond network access to the service.

Blast Radius

• The attacker reads arbitrary files from the host filesystem by stepping outside the intended image-cache directory using traversal sequences.
• Sensitive files such as environment configuration files, database credentials, API keys, and private keys stored on the host are directly readable.
• Application source code and internal directory structure can be enumerated, providing a map for further attacks against the environment.