PT-2026-36133 · Shopizer · Shopizer

Arron-Bit · Published 2026-04-30 · Updated 2026-05-12 · CVE-2026-36767

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions shopizer version 3.2.5

Description A path traversal issue in the '/content/images/add' endpoint allows attackers to write arbitrary files to any writable path using a crafted POST request. Path traversal is a technique that allows an attacker to access or manipulate files and directories outside the intended folder on a server.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-36767

GHSA-F5W4-7CCJ-5M75

Affected Products

Shopizer

References · 10

• 🔥 https://github.com/shopizer-ecommerce/shopizer/issues/1091 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-36767 · Security Note
• https://osv.dev/vulnerability/GHSA-f5w4-7ccj-5m75 · Vendor Advisory
• https://github.com/shopizer-ecommerce/shopizer · Note
• https://twitter.com/lyrie_ai/status/2054111008298274835 · Twitter Post
• https://twitter.com/CVEnew/status/2049913893644869946 · Twitter Post
• https://t.me/CVEtracker/52334 · Telegram Post
• https://twitter.com/lyrie_ai/status/2054111011406324093 · Twitter Post
• https://twitter.com/lyrie_ai/status/2054111009153986856 · Twitter Post
• https://twitter.com/infoflowcloud/status/2049914623592120718 · Twitter Post