{"id":"CVE-2025-52922","aliases":["EUVD-2025-18867","GHSA-qj3r-7m99-68wq"],"status":"published","title":"Innoshop through 0.4.1 allows directory traversal via FileManager API endpoints. An authenticated...","description":"Innoshop through 0.4.1 allows directory traversal via FileManager API endpoints. An authenticated attacker with access to the admin panel could abuse this to: (1) fully map the filesystem structure via the /api/file_manager/files?base_folder= endpoint, (2) create arbitrary directories on the server via the /api/file_manager/directories endpoint, (3) read arbitrary files from the server by copying the file to a readable location within the application via the /api/file_manager/copy_files endpoint, {4) delete arbitrary files from the server via a DELETE request to /api/file_manager/files, or (5) create arbitrary files on the server by uploading them and then leveraging the /api/file_manager/move_files endpoint to move them anywhere in the filesystem.","severity":{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00465,"percentile":0.40682,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-23"],"published":"2025-06-23T00:00:00Z","modified":"2026-10-28T02:30:31Z","products":[{"vendor":"innocommerce","product":"innoshop"},{"vendor":"innoshop","product":"innoshop"}],"references":[{"url":"https://github.com/innocommerce/innoshop","tags":["package"]},{"url":"https://medium.com/@The_Hiker/how-i-found-multiple-cves-in-innoshop-0-4-1-12c8f84ad87f","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-52922","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-qj3r-7m99-68wq"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/52xxx/CVE-2025-52922.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-52922","description":"Innoshop through 0.4.1 allows directory traversal via FileManager API endpoints. An authenticated attacker with access to the admin panel could abuse this to: (1) fully map the filesystem structure via the /api/file_manager/files?base_folder= endpoint, (2) create arbitrary directories on the server via the /api/file_manager/directories endpoint, (3) read arbitrary files from the server by copying the file to a readable location within the application via the /api/file_manager/copy_files endpoint, {4) delete arbitrary files from the server via a DELETE request to /api/file_manager/files, or (5) create arbitrary files on the server by uploading them and then leveraging the /api/file_manager/move_files endpoint to move them anywhere in the filesystem.","status":"published","published":"2025-06-23T00:00:00Z","modified":"2025-06-23T13:51:14.993Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-23"],"updated_at":"2026-11-02T14:32:31.309974Z"}],"euvd":[{"id":"EUVD-2025-18867","description":"Innoshop through 0.4.1 allows directory traversal via FileManager API endpoints. An authenticated attacker with access to the admin panel could abuse this to: (1) fully map the filesystem structure via the /api/file_manager/files?base_folder= endpoint, (2) create arbitrary directories on the server via the /api/file_manager/directories endpoint, (3) read arbitrary files from the server by copying the file to a readable location within the application via the /api/file_manager/copy_files endpoint, {4) delete arbitrary files from the server via a DELETE request to /api/file_manager/files, or (5) create arbitrary files on the server by uploading them and then leveraging the /api/file_manager/move_files endpoint to move them anywhere in the filesystem.","status":"published","published":"2025-06-23T00:00:00Z","modified":"2025-06-23T13:51:14Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T20:32:18.218874Z"}],"ghsa":[{"id":"GHSA-qj3r-7m99-68wq","title":"Innoshop through 0.4.1 allows directory traversal via FileManager API endpoints. An authenticated...","description":"Innoshop through 0.4.1 allows directory traversal via FileManager API endpoints. An authenticated attacker with access to the admin panel could abuse this to: (1) fully map the filesystem structure via the /api/file_manager/files?base_folder= endpoint, (2) create arbitrary directories on the server via the /api/file_manager/directories endpoint, (3) read arbitrary files from the server by copying the file to a readable location within the application via the /api/file_manager/copy_files endpoint, {4) delete arbitrary files from the server via a DELETE request to /api/file_manager/files, or (5) create arbitrary files on the server by uploading them and then leveraging the /api/file_manager/move_files endpoint to move them anywhere in the filesystem.","status":"published","published":"2025-06-23T21:31:56Z","modified":"2025-06-23T21:32:02Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-23"],"updated_at":"2026-11-02T15:02:48.872885Z"}],"nvd":[{"id":"CVE-2025-52922","description":"Innoshop through 0.4.1 allows directory traversal via FileManager API endpoints. An authenticated attacker with access to the admin panel could abuse this to: (1) fully map the filesystem structure via the /api/file_manager/files?base_folder= endpoint, (2) create arbitrary directories on the server via the /api/file_manager/directories endpoint, (3) read arbitrary files from the server by copying the file to a readable location within the application via the /api/file_manager/copy_files endpoint, {4) delete arbitrary files from the server via a DELETE request to /api/file_manager/files, or (5) create arbitrary files on the server by uploading them and then leveraging the /api/file_manager/move_files endpoint to move them anywhere in the filesystem.","status":"published","published":"2025-06-23T12:15:23.15Z","modified":"2026-06-17T09:37:17.14Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","level":"high","assessor":"secondary"}],"cwes":["CWE-23"],"updated_at":"2026-11-02T14:11:14.091082Z"}],"osv":[{"id":"CVE-2025-52922","description":"Innoshop through 0.4.1 allows directory traversal via FileManager API endpoints. An authenticated attacker with access to the admin panel could abuse this to: (1) fully map the filesystem structure via the /api/file_manager/files?base_folder= endpoint, (2) create arbitrary directories on the server via the /api/file_manager/directories endpoint, (3) read arbitrary files from the server by copying the file to a readable location within the application via the /api/file_manager/copy_files endpoint, {4) delete arbitrary files from the server via a DELETE request to /api/file_manager/files, or (5) create arbitrary files on the server by uploading them and then leveraging the /api/file_manager/move_files endpoint to move them anywhere in the filesystem.","status":"published","published":"2025-06-23T00:00:00Z","modified":"2026-10-28T02:30:31.688417782Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-23"],"updated_at":"2026-11-02T15:44:50.45326Z"}]}}