CVE-2026-36767
Published: 30 April 2026
Summary
CVE-2026-36767 is a critical-severity Path Traversal (CWE-22) vulnerability. Its CVSS base score is 10.0 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 33.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-36767, published on 2026-04-30, is a path traversal vulnerability (CWE-22) in Shopizer version 3.2.5. The issue affects the /content/images/add endpoint, where attackers can write arbitrary files to any writable path on the server via a crafted POST request. It carries a CVSS v3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), marking it as critically severe due to its network accessibility, low attack complexity, lack of prerequisites, and broad impacts across confidentiality, integrity, and availability.
Unauthenticated remote attackers can exploit this vulnerability by sending a specially crafted POST request to the vulnerable endpoint. Successful exploitation enables arbitrary file writes to any writable directory, potentially allowing attackers to overwrite critical files, deploy malicious payloads, or escalate privileges depending on server permissions and configuration.
Advisories and mitigation details are available in the Shopizer GitHub repository (https://github.com/shopizer-ecommerce/shopizer) and related issue tracker (https://github.com/shopizer-ecommerce/shopizer/issues/1091), where patches or workarounds may be documented.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-26401
Vulnerability details
A path traversal vulnerability in the /content/images/add endpoint of shopizer v3.2.5 allows attackers write arbitrary files to any writeable path via a crafted POST request.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Path traversal enables unauthenticated remote arbitrary file write on public-facing app (T1190), direct ingress of malicious payloads/tools (T1105), and deployment of web shells for execution/persistence (T1505.003).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates path traversal vulnerability by enforcing input validation on file paths in POST requests to the /content/images/add endpoint to block sequences like '../'.
Requires timely patching of the specific flaw in Shopizer v3.2.5, with fixes documented in the GitHub repository, to eliminate the arbitrary file write capability.
Boundary protection via web application firewalls monitors and blocks crafted POST requests containing path traversal payloads at external interfaces.