CVE-2026-96898

HighCVSS 7.3

Published: 24/09/2026(UTC)Updated: 24/09/2026(UTC)Translated: 24/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.42%

34th percentile - higher than 34% of all known CVEs

Summary

A vulnerability was detected in ShopXO up to 2.2.7 in an unknown functionality of config/ueditor.php in the Ueditor Upload Interface component. Manipulation of the path_type argument results in path traversal. The attack can be launched remotely and the exploit is publicly available.

Risk Assessment

A remote attacker could exploit the path traversal to access files outside the intended directory, potentially leading to disclosure of sensitive data or further system compromise.

Recommendation

Update ShopXO to a version later than 2.2.7, and until a fix is available, restrict access to the Ueditor Upload Interface.

Other vulnerabilities in ShopXO

CVE-2026-12204High
A vulnerability was found in ShopXO up to version 6.7.1 in the functions OrderClose, OrderSuccess, PayLogOrderClose, and GoodsGiveIntegral in the file app/api/controller/Crontab.php of the Scheduled Task Endpoint component. Manipulation can lead to authorization bypass. The attack can be executed remotely, and the exploit has been publicly disclosed.

Original NVD description (English source)

A vulnerability was detected in yhx070424 ShopXO up to 2.2.7. Affected by this vulnerability is an unknown functionality of the file config/ueditor.php of the component Ueditor Upload Interface. The manipulation of the argument path_type results in path traversal. It is possible to launch the attack remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS