CVE-2026-116223 Details
Description
A flaw has been found in icret EasyImage up to 2.8.7. The impacted element is an unknown function of the file app/del.php. Executing a manipulation of the argument hash can lead to improper privilege management. The attack can be launched remotely. The exploit has been published and may be used. This patch is called b12cb67d447bcbb67e21c8f011d0f5638229760c. A patch should be applied to remediate this issue.
A vulnerability in icret EasyImage versions through 2.8.7 allows for unauthenticated arbitrary file deletion. The issue arises in the file app/del.php, where a specific function processes deletion requests. The vulnerability is exploited by manipulating the 'hash' argument, which is not properly authenticated before the deletion action is performed. This flaw can be exploited remotely, taking advantage of the application's default settings that allow anonymous uploads.
The vulnerability has been fixed in the latest version of the application. Users should update to this version. Additionally, it is recommended to implement server-side measures that prevent the execution of scripts in the upload directory and to secure the configuration directory from web access.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 26, 2026CISA-ADP
Assessed Nov 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://gist.github.com/yyz8097/bc58546872ad90208d2b35260d84b1d9 | [email protected] | ExploitTechnical Analysis |
| https://github.com/icret/EasyImages2.0/commit/b12cb67d447bcbb67e21c8f011d0f5638229760c | [email protected] | Source CodeVendor |
| https://github.com/icret/EasyImages2.0/issues/283 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://vuldb.com/cve/CVE-2026-116223 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1004976 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/426203 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/426203/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-266 | Incorrect Privilege Assignment | [email protected] |
| CWE-269 | Improper Privilege Management | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| icret EasyImage | <= 2.8.7 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 2, 2026 | CVE Modified | CISA-ADP |
| Oct 26, 2026 | New CVE Received | [email protected] |