CVE-2026-82665: GEOFlow Path Traversal Vulnerability

CVE-2026-82665 Overview

CVE-2026-82665 is a path traversal vulnerability [CWE-22] in the yaojingang GEOFlow application through version 2.1.0. The flaw resides in the unlink function within app/Http/Controllers/Admin/ImageLibraryController.php, part of the Image Library Cleanup component. Attackers can manipulate the file_path argument to escape the intended image directory and delete arbitrary files on the host. The attack is performed remotely over the network, though it requires high-privilege authentication. A public exploit is available. The maintainer released fixed version 2.1.1 with commit 67abfd864a15d169a78429f3290c91cb3b93e849.

Critical Impact
An authenticated administrator can traverse outside the image library directory using crafted file_path values, resulting in arbitrary file deletion that can impact application integrity and availability.

Affected Products

yaojingang GEOFlow versions up to and including 2.1.0
Component: Image Library Cleanup (app/Http/Controllers/Admin/ImageLibraryController.php)
Vulnerable function: unlink

Discovery Timeline

2026-08-31 - CVE-2026-82665 published to NVD
2026-08-31 - Last updated in NVD database

Technical Details for CVE-2026-82665

Vulnerability Analysis

GEOFlow exposes an administrative image cleanup endpoint that accepts a file_path parameter and passes it to PHP's unlink function. The controller does not canonicalize the supplied path or confine it to the configured upload directory. An authenticated attacker submits sequences such as ../ to reach files outside the image library root. The result is arbitrary file deletion within the process user's filesystem permissions.

The upstream project scoped uploads under GEOFLOW_UPLOAD_URL=/assets/images/, but the deletion routine did not enforce that boundary. The patch introduces a legacy compatibility flag GEOFLOW_LEGACY_IMAGE_PATH_INPUT (default false) so clients can no longer submit raw image paths outside a controlled migration window.

Root Cause

The root cause is missing input validation and path normalization on the file_path argument before invoking unlink. The controller trusts client-supplied paths without verifying that the resolved absolute path stays under the sanctioned image directory. This maps directly to CWE-22, Improper Limitation of a Pathname to a Restricted Directory.

Attack Vector

Exploitation requires an authenticated session with administrative privileges to reach the Image Library Cleanup functionality. The attacker issues a request to the cleanup endpoint with a file_path value containing directory traversal sequences. Because the exploit code is public, opportunistic use against exposed GEOFlow admin panels is realistic.

text

// Patch context from commit 67abfd864a15d169a78429f3290c91cb3b93e849
// New environment flag added to gate legacy client behavior:

# Legacy client compatibility switch for direct image path submission.
# Default disabled; only enable during a controlled migration window.
GEOFLOW_LEGACY_IMAGE_PATH_INPUT=false

# Managed image deletion remains disabled until all processes are upgraded
# and managed image hash readiness is confirmed.
GEOFLOW_MANAGED_IMAGE_DELETION_ENABLED=false

# Short threshold used by the security audit to flag interrupted
# deleting operations and long-term orphan objects.
GEOFLOW_SECURITY_AUDIT_DELETING_STALE_MINUTES=15

Source: GitHub GEOFlow Commit 67abfd8

Detection Methods for CVE-2026-82665

Indicators of Compromise

HTTP requests to admin image cleanup routes containing ../, ..\, URL-encoded traversal sequences (%2e%2e%2f), or absolute paths in the file_path parameter.
Unexpected deletion events on files outside the /assets/images/ upload directory owned by the GEOFlow application user.
Application error logs referencing unlink failures on system paths not associated with the image library.

Detection Strategies

Inspect web server and application logs for admin-authenticated requests to ImageLibraryController handlers that carry non-canonical file_path values.
Compare deletion audit trails against the managed image inventory and flag deletions of files without a corresponding library reference.
Alert on GEOFlow instances still reporting version 2.1.0 or earlier via banner or admin dashboard fingerprinting.

Monitoring Recommendations

Enable filesystem auditing on the GEOFlow deployment directory and adjacent application paths to record deletion syscalls by the web server user.
Track administrator session activity and correlate cleanup actions with the authenticated user identity for forensic review.
Monitor GitHub advisories on the GEOFlow repository for follow-on fixes and hardening changes.

How to Mitigate CVE-2026-82665

Immediate Actions Required

Upgrade GEOFlow to version 2.1.1 or later, which contains the fix from commit 67abfd864a15d169a78429f3290c91cb3b93e849.
Restrict administrative access to the GEOFlow console using network controls and enforce strong authentication for privileged accounts.
Review recent deletion activity on the application host to confirm no files outside the image library have been removed.

Patch Information

The maintainer published the fix in GEOFlow Release v2.1.1. The change is tracked in Pull Request #61 and Issue #60. Additional context is available on VulDB CVE-2026-82665.

Workarounds

Leave GEOFLOW_LEGACY_IMAGE_PATH_INPUT set to false so legacy clients cannot submit raw image paths to the cleanup routine.
Keep GEOFLOW_MANAGED_IMAGE_DELETION_ENABLED=false until every web, worker, and scheduler process is running the patched build.
Place the admin interface behind a VPN or IP allowlist to reduce exposure while patching is scheduled.

bash

# Recommended environment configuration after upgrading to v2.1.1
GEOFLOW_LEGACY_IMAGE_PATH_INPUT=false
GEOFLOW_MANAGED_IMAGE_DELETION_ENABLED=false
GEOFLOW_SECURITY_AUDIT_DELETING_STALE_MINUTES=15
GEOFLOW_UPLOAD_URL=/assets/images/
GEOFLOW_MAX_UPLOAD_BYTES=2097152