Description

A vulnerability was detected in yaojingang GEOFlow up to 2.1.0. This vulnerability affects the function unlink of the file app/Http/Controllers/Admin/ImageLibraryController.php of the component Image Library Cleanup. The manipulation of the argument file_path results in path traversal. The attack may be performed from remote. The exploit is now public and may be used. Upgrading to version 2.1.1 is able to resolve this issue. The patch is identified as 67abfd864a15d169a78429f3290c91cb3b93e849. It is recommended to upgrade the affected component.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.8",
  "pubDate": "2026-08-31T09:17:04.520Z",
  "pubdate": "2026-08-31T09:17:04.520Z",
  "executiveSummary": "A path traversal vulnerability has been identified in the yaojingang GEOFlow component, specifically within the Image Library Cleanup functionality.\nThe vulnerability originates in the app/Http/Controllers/Admin/ImageLibraryController.php file, where insufficient input validation allows an attacker to manipulate the file_path argument.\nThis flaw enables remote attackers to perform unauthorized file system operations, specifically arbitrary file deletion, by traversing outside the intended directory scope.\nThe vulnerability is rated as high risk due to the potential for unauthorized data destruction and impact on system integrity.\nSuccessful exploitation requires no specialized access beyond network connectivity to the affected system. The issue affects all versions of GEOFlow up to and including 2.1.0.\nUsers are strongly advised to upgrade to version 2.1.1 to remediate this security risk.",
  "technicalDetails": "The vulnerability is categorized as a path traversal flaw, specifically enabling arbitrary file deletion, located within the unlink function of the ImageLibraryController component.\nThe root cause of this vulnerability is the improper sanitization of the file_path argument provided by the user in the Image Library Cleanup module.\nWhen the unlink function is invoked, it accepts a user-supplied file path string. Because the application fails to adequately validate or restrict this input against a restricted base directory, it allows for the inclusion of directory traversal sequences such as '../'.\nAn attacker can exploit this by crafting a malicious payload for the file_path argument, injecting traversal sequences to escape the intended directory structure. When the application processes this input, the system-level unlink command is executed on the attacker-specified path.\nThe attack flow begins with the adversary identifying the endpoint associated with the Image Library Cleanup functionality. By intercepting the request and modifying the file_path parameter to point to a sensitive system file or configuration file outside the media directory, the adversary forces the server to delete that file.\nThis vulnerability is exploitable remotely, meaning an attacker does not need local access to the server to trigger the deletion. If the application runs with elevated privileges, the attacker could potentially delete critical system files, leading to a denial-of-service condition or severe system instability.\nThe vulnerability exists in app/Http/Controllers/Admin/ImageLibraryController.php and affects all versions up to 2.1.0. The lack of an established allow-list or regex-based path validation for user-submitted file paths is the primary architectural weakness leading to this exposure. The patch identified by commit hash 67abfd864a15d169a78429f3290c91cb3b93e849 addresses this by implementing strict input validation or path normalization logic that prevents traversal outside the designated image library root."
}