CVE-2026-96898

Description

A vulnerability was detected in yhx070424 ShopXO up to 2.2.7. Affected by this vulnerability is an unknown functionality of the file config/ueditor.php of the component Ueditor Upload Interface. The manipulation of the argument path_type results in path traversal. It is possible to launch the attack remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Overview

State: PUBLISHED
Assigner (CNA): VulDB
CVSS severity: MEDIUM
CVSS score: 6.9 / 10
CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Effective score: 6.9 / 10 MEDIUM source: CNA overview
CWE(s): CWE-22
Reserved: 2026-09-23
Published: 2026-09-24 03:30 UTC
Last updated: 2026-09-24 15:17 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96898.json

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

EPSS score: 0.0042 (probability of exploitation in next 30 days)
EPSS percentile: 34.00% vs all CVEs — higher = more likely to be exploited, as of 2026-09-24

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2026-85789
Assigner: VulDB
Published: Sep 24, 2026, 3:30:15 AM
Updated: Sep 24, 2026, 3:17:45 PM
EUVD base score (CVSS 4.0): 6.9 / 10
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
EUVD-reported EPSS: 0.4200
Vendors: yhx070424
Products: ShopXO (2.2.6)

ShopXO (2.2.7)

ShopXO (2.2.0)

ShopXO (2.2.4)

ShopXO (2.2.5)

ShopXO (2.2.3)

ShopXO (2.2.2)

ShopXO (2.2.1)
Aliases: GHSA-prgg-jw4q-hhmp

ENISA description: A vulnerability was detected in yhx070424 ShopXO up to 2.2.7. Affected by this vulnerability is an unknown functionality of the file config/ueditor.php of the component Ueditor Upload Interface. The manipulation of the argument path_type results in path traversal. It is possible to launch the attack remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

EUVD references (6)

Affected products (1)

Vendor	Product	Versions	Platforms
yhx070424	ShopXO	`2.2.0` (affected), `2.2.1` (affected), `2.2.2` (affected), `2.2.3` (affected), `2.2.4` (affected), `2.2.5` (affected), `2.2.6` (affected), `2.2.7` (affected)	—

Vendor references (6)

References embedded in the original CVE record by the assigning CNA.

VDB-409201 | yhx070424 ShopXO Ueditor Upload ueditor.php path traversal vdb-entrytechnical-description
VDB-409201 | CTI Indicators (IOB, IOC, TTP, IOA) signaturepermissions-required
CVE-2026-96898 | CVE Analysis and Report third-party-advisory
Submit #906413 | zongzhige shopXO 2.2.5 Path Traversal third-party-advisory
https://gitee.com/yhx070424/shopxo/issues/IK4LPH exploitissue-tracking
https://gitee.com/yhx070424/shopxo/ product

Web references (0)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

No web references attached yet.

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-96898.json.

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-96898",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-24T15:17:23.756599Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-24T15:17:45.309Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:shopxo:shopxo:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Ueditor Upload Interface"
          ],
          "product": "ShopXO",
          "vendor": "yhx070424",
          "versions": [
            {
              "status": "affected",
              "version": "2.2.0"
            },
            {
              "status": "affected",
              "version": "2.2.1"
            },
            {
              "status": "affected",
              "version": "2.2.2"
            },
            {
              "status": "affected",
              "version": "2.2.3"
            },
            {
              "status": "affected",
              "version": "2.2.4"
            },
            {
              "status": "affected",
              "version": "2.2.5"
            },
            {
              "status": "affected",
              "version": "2.2.6"
            },
            {
              "status": "affected",
              "version": "2.2.7"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "0n1on (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was detected in yhx070424 ShopXO up to 2.2.7. Affected by this vulnerability is an unknown functionality of the file config/ueditor.php of the component Ueditor Upload Interface. The manipulation of the argument path_type results in path traversal. It is possible to launch the attack remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 7.5,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "Path Traversal",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-24T03:30:15.445Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-409201 | yhx070424 ShopXO Ueditor Upload ueditor.php path traversal",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/409201"
        },
        {
          "name": "VDB-409201 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/409201/cti"
        },
        {
          "name": "CVE-2026-96898 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-96898"
        },
        {
          "name": "Submit #906413 | zongzhige shopXO 2.2.5 Path Traversal",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/906413"
        },
        {
          "tags": [
            "exploit",
            "issue-tracking"
          ],
          "url": "https://gitee.com/yhx070424/shopxo/issues/IK4LPH"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://gitee.com/yhx070424/shopxo/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-23T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-09-23T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-09-23T21:59:49.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "yhx070424 ShopXO Ueditor Upload ueditor.php path traversal",
      "x_generator": [
        "VulDB PVTS v202609"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-96898",
    "datePublished": "2026-09-24T03:30:15.445Z",
    "dateReserved": "2026-09-23T19:54:39.599Z",
    "dateUpdated": "2026-09-24T15:17:45.309Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}