CVE-2026-42028: novaGallery Path Traversal Vulnerability

CVE-2026-42028 Overview

CVE-2026-42028 is a path traversal vulnerability in novaGallery, a PHP-based image gallery application. Versions prior to 2.1.1 allow unauthenticated remote attackers to read image files located outside the intended gallery root directory. The flaw is categorized under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). The vendor has remediated the issue in novaGallery version 2.1.1.

Critical Impact
Unauthenticated network attackers can read image files outside the gallery root directory, leading to potential exposure of confidential image assets stored on the server.

Affected Products

novaGallery versions prior to 2.1.1
PHP-based deployments using the novafacile/novagallery package
Web servers hosting novaGallery accessible over the network

Discovery Timeline

2026-05-08 - CVE-2026-42028 published to NVD
2026-05-12 - Last updated in NVD database

Technical Details for CVE-2026-42028

Vulnerability Analysis

The vulnerability resides in novaGallery's image file retrieval logic. The application accepts user-supplied input that influences file system paths without performing adequate normalization or containment checks. As a result, an attacker can supply directory traversal sequences such as ../ to escape the intended gallery root directory and access arbitrary image files elsewhere on the file system.

Because the attack is conducted over the network without authentication or user interaction, exploitation requires only the ability to send HTTP requests to a vulnerable instance. The impact is limited to confidentiality of readable image files; integrity and availability of the host are not directly affected by this flaw.

The EPSS probability for this CVE is 0.112%, indicating a low predicted likelihood of exploitation in the near term. No public proof-of-concept exploit, exploit database entry, or CISA KEV listing has been recorded for this issue.

Root Cause

The root cause is insufficient sanitization of path components used in image lookup operations. The vulnerable code path does not validate that the resolved file path remains within the configured gallery root. Fix details are available in the GitHub commit 46fe7b0 that introduced version 2.1.1.

Attack Vector

An unauthenticated remote attacker sends a crafted HTTP request containing traversal sequences in a parameter that the application uses to construct an image path. The server resolves the path outside the intended directory and returns the contents of the targeted file if it matches the expected image-handling logic. Refer to the GitHub Security Advisory GHSA-wv5j-98c7-frm9 for vendor-confirmed details.

Detection Methods for CVE-2026-42028

Indicators of Compromise

HTTP requests containing ../, ..%2F, or encoded traversal patterns in image-related query parameters
Access log entries referencing image files outside the configured gallery root directory
Repeated requests probing varied directory depths against novaGallery endpoints

Detection Strategies

Inspect web server access logs for path traversal patterns directed at novaGallery URLs
Deploy web application firewall (WAF) rules that block traversal sequences in parameters used by the gallery
Compare requested file paths against the expected gallery root and alert on resolved paths outside it

Monitoring Recommendations

Enable verbose request logging on web servers fronting novaGallery deployments
Monitor for anomalous file read operations originating from the web server process
Track outbound responses with unexpectedly large or non-gallery image payloads

How to Mitigate CVE-2026-42028

Immediate Actions Required

Upgrade novaGallery to version 2.1.1 or later using the GitHub Release v2.1.1
Audit access logs for prior traversal attempts against gallery endpoints
Restrict file system permissions so the web server user cannot read sensitive directories outside the gallery root

Patch Information

The vendor released novaGallery 2.1.1 containing the fix. The remediation is committed in GitHub commit 46fe7b0f79f429e18c8cff3f92360c4513732ba6. Administrators should replace all files from the prior installation and verify the version after deployment.

Workarounds

Place a WAF rule in front of novaGallery to reject requests containing .. sequences in parameters
Run the PHP process under a chrooted environment or restricted user with no read access outside the gallery directory
Temporarily remove public access to novaGallery until the upgrade to 2.1.1 is completed

bash

# Example WAF/nginx rule to block traversal in query strings
if ($args ~* "\.\./|\.\.%2[fF]|%2[eE]%2[eE]/") {
    return 403;
}