CVE-2026-36767
published 2026-04-30CVE-2026-36767: A path traversal vulnerability in the /content/images/add endpoint of shopizer v3.2.5 allows attackers write arbitrary files to any writeable path via a…
PriorityP262critical10CVSS 3.1
AVNACLPRNUINSCCHIHAH
EPSS
0.41%
32.9th percentile
A path traversal vulnerability in the /content/images/add endpoint of shopizer v3.2.5 allows attackers write arbitrary files to any writeable path via a crafted POST request.
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
shopizer 3.2.5 POST /content/images/add path traversal (ID 1091)
vuldb·2026-04-30·CVSS 10.0
CVE-2026-36767 [CRITICAL] shopizer 3.2.5 POST /content/images/add path traversal (ID 1091)
A vulnerability, which was classified as critical, has been found in shopizer 3.2.5. This impacts an unknown function of the file /content/images/add of the component POST Handler. The manipulation leads to path traversal.
This vulnerability is uniquely identified as CVE-2026-36767. The attack is possible to be carried out remotely. No exploit exists.
GHSA
Shopizer has a path traversal issue
ghsa·2026-04-30
CVE-2026-36767 [CRITICAL] CWE-22 Shopizer has a path traversal issue
Shopizer has a path traversal issue
A path traversal vulnerability in the /content/images/add endpoint of shopizer through version 3.2.5 allows attackers write arbitrary files to any writeable path via a crafted POST request.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-04-30
Published