PT-2026-39151 · Unknown · Novagallery

Kitu232 · CVE-2026-42028 · Published 2026-05-08 · Updated 2026-05-08

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions novaGallery versions prior to 2.1.1

Description A path traversal issue in this PHP image gallery allows unauthenticated users to read image files located outside the intended gallery root directory. Path traversal is a flaw that lets an attacker manipulate file paths to access files and directories stored outside the web root folder.

Recommendations Update to version 2.1.1.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-42028

GHSA-WV5J-98C7-FRM9

Affected Products

Novagallery

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42028.json · Exploit
• 🔥 https://github.com/novafacile/novagallery/security/advisories/GHSA-wv5j-98c7-frm9 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-42028 · Security Note
• https://osv.dev/vulnerability/CVE-2026-42028 · Vendor Advisory
• https://github.com/novafacile/novagallery/commit/46fe7b0f79f429e18c8cff3f92360c4513732ba6 · Note
• https://github.com/novafacile/novagallery/releases/tag/v2.1.1 · Note
• https://t.me/CVEtracker/53142 · Telegram Post
• https://twitter.com/CVEnew/status/2052810964483862955 · Twitter Post