Description

The Link Library WordPress plugin before 7.9.6 does not sanitize a user-supplied destination folder before writing a generated image to disk, allowing users with the Contributor role and above to create directories and write or overwrite image files anywhere the web server can write, including outside the site's document root. The written file name is always numeric with a fixed image extension, so executable code cannot be planted this way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.1",
  "pubDate": "2026-09-25T07:16:54.437Z",
  "pubdate": "2026-09-25T07:16:54.437Z",
  "executiveSummary": "The Link Library WordPress plugin, specifically versions prior to 7.9.6, is susceptible to an arbitrary file write vulnerability resulting from insufficient input sanitization of the destination directory parameter.\nThe vulnerability allows authenticated users with the Contributor role or higher to manipulate the file system by writing generated image files to unauthorized locations.\nWhile the file naming convention is restricted to numeric identifiers with fixed image extensions, preventing direct remote code execution via executable script injection, the ability to write files outside the web document root poses a significant risk to system integrity.\nAn attacker can leverage this flaw to overwrite critical system configuration files or sensitive assets if the web server process maintains write permissions in those directories.\nSuccessful exploitation requires authenticated access to the WordPress dashboard, limiting the attack surface to users possessing at least a Contributor-level privilege.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper handling of user-supplied input regarding the destination folder parameter within the plugin's image generation functionality. The application fails to implement adequate directory traversal protection or path validation, allowing a malicious actor to inject directory path modifiers.\nExploitation is achieved by manipulating the destination folder configuration during the execution of the image generation routine. Because the plugin does not sanitize this input, the backend script constructs a file path that is not constrained to the intended uploads directory. This allows the application to traverse the file system hierarchy, reaching directories outside the site's document root, provided the web server user (e.g., www-data) possesses write permissions in the target location.\nThe attack flow follows a sequential process: First, the authenticated user triggers the plugin's image generation process while intercepting or crafting the request to include a malicious path string in the destination folder field. Second, the plugin's backend component receives this unsanitized path and uses it to define the write operation target. Finally, the server-side process writes a generated image file—following a fixed numeric naming convention—to the specified destination.\nAlthough the payload is limited to image file formats with a fixed extension, which effectively mitigates the risk of direct remote code execution (RCE) via web shell injection, the impact remains severe. An attacker can perform a 'Denial of Service' by overwriting critical application configuration files or image assets, potentially causing site-wide malfunctions or corrupting essential data stored on the host filesystem.\nThis vulnerability is strictly an authenticated risk, requiring valid credentials and sufficient privileges to interact with the plugin's functionality. The scope of the attack is constrained by the system's filesystem permissions rather than the application's internal logic, highlighting a reliance on the principle of least privilege for the web server user."
}