Description

InnoShop 0.9.2 contains a local file disclosure vulnerability that allows authenticated administrators with files_create permission to read server files by abusing the AI Core MCP file_upload tool's source argument. Attackers can supply file:// or php:// stream wrappers passed to file_get_contents(), storing contents on the public media disk to expose the .env file with APP_KEY and database credentials.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.4",
  "pubDate": "2026-10-10T19:16:57.320Z",
  "pubdate": "2026-10-10T19:16:57.320Z",
  "executiveSummary": "InnoShop version 0.9.2 is susceptible to a local file disclosure vulnerability stemming from insecure handling of the AI Core MCP file_upload tool.\nThe vulnerability allows an authenticated administrator with 'files_create' permissions to bypass intended file access controls.\nBy manipulating the 'source' argument, an attacker can leverage PHP stream wrappers, such as 'file://' or 'php://', to read arbitrary files from the underlying server filesystem.\nSuccessful exploitation results in the unauthorized exposure of sensitive configuration files, including the '.env' file, which typically contains critical security credentials such as the 'APP_KEY' and database connection strings.\nThe vulnerability represents a high-risk security flaw as it enables the extraction of credentials that can facilitate further unauthorized access, privilege escalation, or full system compromise.\nExploitation requires active authentication with administrative privileges, specifically the ability to manage file uploads within the application.",
  "technicalDetails": "The root cause of the vulnerability resides in the insufficient validation and sanitization of the 'source' input parameter within the AI Core MCP 'file_upload' tool.\nWhen a user triggers the 'file_upload' function, the application utilizes the 'source' argument as a parameter for 'file_get_contents()' without implementing an allowlist or path validation mechanism.\nBecause the underlying PHP configuration facilitates the use of stream wrappers, an attacker can supply malicious URI schemes to bypass standard directory traversal protections.\nAn authenticated attacker with 'files_create' privileges can craft a request where the 'source' argument is set to 'file:///var/www/html/.env' or equivalent pathing. The application proceeds to execute 'file_get_contents()' on the provided URI.\nThe PHP interpreter processes the request by accessing the sensitive file specified in the URI scheme. The application then stores the contents of the read file into the public media disk associated with the InnoShop platform.\nOnce the file contents are written to the public media disk, the attacker can retrieve the sensitive data by accessing the file through the application's public web directory, thereby effectively disclosing the contents of restricted server files.\nThe impact of this disclosure is critical; the 'APP_KEY' is a foundational secret in many PHP frameworks (such as Laravel) used for encryption and signing session cookies. Exposure of this key, combined with database credentials, allows an attacker to decrypt sensitive session data, forge administrative tokens, and gain unauthorized write or administrative access to the backend database.\nThis vulnerability is restricted to authenticated users with 'files_create' capabilities, though the severity is high due to the potential for complete environment compromise."
}