CVE-2026-88392CWE-22path-traversal

CVE-2026-88392

High · published October 5, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
52.3
In the wild
Unconfirmed
What it is

Unimall v4 is vulnerable to Directory Traversal in FileUploadController.local(). This allows an attacker to execute arbitrary code.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00692 · 52.3th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-10-05T19:17Z
References (2)
https://github.com/fangtang7/CVE/blob/main/Unimall/file.md · [email protected]https://github.com/fangtang7/CVE/blob/main/Unimall/file.md · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 07 OCT 03:43Z
    EPSS moved — → 0%
    epss
  • 05 OCT 00:00Z
    Unimall v4 is vulnerable to Directory Traversal in FileUploadController.local()
    cvelistv5