Description

A vulnerability was detected in yhx070424 ShopXO up to 2.2.7. Affected by this vulnerability is an unknown functionality of the file config/ueditor.php of the component Ueditor Upload Interface. The manipulation of the argument path_type results in path traversal. It is possible to launch the attack remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-24T04:18:05.833Z",
  "pubdate": "2026-09-24T04:18:05.833Z",
  "executiveSummary": "A path traversal vulnerability exists in the Ueditor upload interface of ShopXO versions up to 2.2.7. This security flaw resides within the config/ueditor.php file, specifically involving the improper handling of the path_type argument.\nThe vulnerability allows an unauthenticated remote attacker to traverse the directory structure of the host server. By manipulating the path_type parameter, an attacker can influence file system operations, potentially leading to unauthorized file access, disclosure of sensitive configuration data, or the ability to influence upload destinations.\nThis vulnerability is classified as critical due to its remote exploitability and the potential for complete compromise of the underlying application file structure. As the project has not responded to vulnerability reports, no official vendor patch is currently available. Organizations utilizing affected versions are at high risk, as public exploit code is available, significantly lowering the barrier to entry for malicious actors.\nThe primary risk implications include the potential for remote code execution, if file upload mechanisms are combined with path traversal, or the exfiltration of sensitive environmental variables and application credentials.",
  "technicalDetails": "The root cause of the vulnerability is insufficient input validation and sanitization of user-supplied data in the path_type argument within the Ueditor component’s configuration handling logic located at config/ueditor.php. The application fails to adequately constrain the directory scope when processing this parameter, enabling the use of directory traversal sequences, such as '../', to escape the intended upload directory.\nExploitation is achieved by sending a specially crafted HTTP request to the vulnerable endpoint associated with the Ueditor interface. The attacker injects path traversal sequences into the path_type argument. When the application processes this input, it resolves the resulting path to locations outside of the application's designated web root or protected directories. Because the component handles file system interactions, this manipulation forces the application to perform operations on unintended files, such as reading configuration files, logs, or sensitive source code files.\nThe attack flow proceeds as follows: 1) The attacker identifies the endpoint corresponding to the Ueditor upload or configuration interface in the ShopXO installation. 2) The attacker intercepts the request and identifies the path_type parameter. 3) The attacker modifies the parameter value to include traversal sequences (e.g., ../../../etc/passwd or similar, depending on the server configuration and OS). 4) The application, failing to validate the input against an allow-list or perform proper normalization, interprets the path as relative to the base directory and processes it. 5) The server performs the requested action on the targeted file, returning data or facilitating unauthorized file placement.\nThis vulnerability is remotely exploitable and does not require prior authentication. The impact is significant as it provides the attacker with primitives to read arbitrary files on the filesystem with the privileges of the web server process. If combined with the file upload functionality of Ueditor, this may also facilitate the placement of malicious scripts (e.g., webshells) in executable directories, leading to full remote code execution on the underlying host. The lack of input validation on path-related parameters in a file handling component constitutes a critical design flaw in the Ueditor integration within ShopXO versions 2.2.7 and below."
}