Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.5.1 - Authenticated (Author+) Path Traversal via ZIP Archive Upload
- ID
- WPSEC-2026-0357
- Plugin
- Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery (nextgen-gallery)
- Affected
- all versions before 4.5.2
- Remediation
- Update to 4.5.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-22
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-22
- Attack surface
- Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery on WPSec AttackSurface
- Fix released
- Published
Description
The NextGEN Gallery plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 4.5.1 via ZIP archive uploads, because the PclZip fallback extraction neither validates archive entry names nor restricts the extraction directory. This makes it possible for authenticated attackers who hold the plugin's image upload or gallery management capability (administrators by default; site owners can delegate it to Author-level users) to write or overwrite files with an allowed image extension, and arbitrary contents, anywhere the web server can write. Exploitation requires the site to use the PclZip fallback, i.e. the PHP ZipArchive extension is unavailable or disabled through the 'unzip_file_use_ziparchive' filter.
References
- https://wpsec.com/vuln/WPSEC-2026-0357/
- https://plugins.svn.wordpress.org/nextgen-gallery/tags/4.5.2/
- https://wordpress.org/plugins/nextgen-gallery/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS