CVE-2026-18959: yushine InnoShop Path Traversal Flaw

CVE-2026-18959 Overview

CVE-2026-18959 is a path traversal vulnerability [CWE-22] affecting yushine InnoShop versions up to 0.8.2. The flaw resides in the FileManagerController::destroyFiles function within innopacks/restapi/routes/panel-api.php, part of the Files Endpoint component. An authenticated attacker can manipulate file path input to reach files outside the intended directory. The attack can be initiated remotely over the network. A public exploit has been released, and the vendor did not respond to disclosure attempts.

Critical Impact
Authenticated remote attackers can traverse directory boundaries via the Files Endpoint to delete files outside the intended scope, affecting integrity and availability of the InnoShop application.

Affected Products

yushine InnoShop versions up to and including 0.8.2
Affected file: innopacks/restapi/routes/panel-api.php
Affected component: Files Endpoint (FileManagerController::destroyFiles)

Discovery Timeline

2026-08-05 - CVE-2026-18959 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-18959

Vulnerability Analysis

The vulnerability exists in the file deletion routine exposed through the InnoShop panel REST API. The FileManagerController::destroyFiles handler accepts file path input from client requests but fails to normalize and validate the path before performing filesystem operations. Attackers with low-privilege authenticated access can supply path segments such as ../ to escape the intended directory root.

Because the vulnerable route lives under innopacks/restapi/routes/panel-api.php, exploitation requires a valid panel session token but no additional user interaction. The impact is limited to partial integrity and availability degradation, as the endpoint targets file destruction rather than arbitrary read or code execution.

Root Cause

The root cause is missing canonicalization and allow-list validation of file path parameters in the destroyFiles action. User-controlled path input is passed to filesystem operations without stripping traversal sequences or confining the resolved path within the designated upload or media directory.

Attack Vector

An authenticated user sends a crafted HTTP request to the panel API endpoint mapped to FileManagerController::destroyFiles. The request body or query parameter contains a filename that includes relative path traversal tokens. The application resolves the path relative to the working directory and deletes files that fall outside the intended scope. No verified code example is publicly attributed; refer to the GitHub Issue Tracker and the VulDB CVE Database Entry for public technical details.

Detection Methods for CVE-2026-18959

Indicators of Compromise

HTTP requests to the InnoShop panel API destroyFiles route containing ../, ..\, URL-encoded %2e%2e%2f, or absolute path prefixes in file parameters.
Unexpected deletion of files outside the InnoShop uploads or media directory recorded by filesystem audit logs.
Panel API access from low-privilege accounts issuing repeated destroyFiles calls with path variations.

Detection Strategies

Deploy web application firewall rules that inspect request bodies and query strings for path traversal sequences targeting the /panel-api/ route prefix.
Correlate authenticated panel API activity with filesystem change events on the InnoShop web root and adjacent directories.
Alert on HTTP 200 responses to destroyFiles calls that follow immediately after directory listing requests, indicating enumeration and deletion patterns.

Monitoring Recommendations

Enable verbose logging on the InnoShop panel API, capturing request path, authenticated user, and parameter values for the file manager endpoints.
Monitor filesystem integrity on the InnoShop installation directory and parent paths for unauthorized deletions.
Track failed and successful authentication events for panel accounts to identify precursor credential abuse.

How to Mitigate CVE-2026-18959

Immediate Actions Required

Restrict network access to the InnoShop panel API to trusted administrator IP ranges until a patched release is available.
Rotate credentials for all panel user accounts and enforce strong password policies to limit low-privilege abuse.
Audit filesystem contents and backups to confirm that no files outside the intended media directory have been deleted.
Review vendor channels and the VulDB Vulnerability Report for updates on a fixed release.

Patch Information

At the time of publication, no vendor patch has been released. The vendor was contacted early about this disclosure but did not respond. Track the GitHub Issue Tracker and the VulDB CVE Database Entry for remediation guidance and future fixed versions above 0.8.2.

Workarounds

Apply a reverse-proxy rule that rejects requests to the destroyFiles route containing .., encoded traversal tokens, or absolute paths.
Run the InnoShop web process under a dedicated low-privilege user and restrict filesystem permissions to the application directory only.
Temporarily disable the file manager functionality in the panel if it is not required for business operations.

bash

# Example NGINX rule to block traversal attempts against the InnoShop panel API
location ~ ^/panel-api/.*/files {
    if ($request_uri ~* "(\.\./|\.\.\\|%2e%2e%2f|%2e%2e/)") {
        return 403;
    }
    proxy_pass http://innoshop_backend;
}