Vulnerabilities / Envira Gallery / WPSEC-2026-0350
Envira Gallery <= 1.16.0 - Authenticated (Contributor+) Path Traversal to Image File Write via 'crop_position' Gallery Setting
Low 3.1
CWE-22Fixed in 1.16.1
- ID
- WPSEC-2026-0350
- Plugin
- Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More (envira-gallery-lite)
- Affected
- from 1.8.5 before 1.16.1
- Remediation
- Update to 1.16.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-22
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- Envira Gallery on WPSec AttackSurface
- Fix released
- Published
Description
The Envira Gallery plugin for WordPress is vulnerable to Path Traversal via the crop_position gallery setting in versions 1.8.5 through 1.16.0. The REST API gallery_data field stored crop_position without validation, and the value was appended unchecked to the file name of the cropped image the plugin generates when the gallery is read through the REST API. This makes it possible for authenticated attackers, with contributor-level access and above, to write or overwrite image files (with the source image's extension) outside the uploads directory on sites where the GD image editor is in use.
References
- https://wpsec.com/vuln/WPSEC-2026-0350/
- https://plugins.svn.wordpress.org/envira-gallery-lite/tags/1.16.1/
- https://wordpress.org/plugins/envira-gallery-lite/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS