CVE-2026-3695 - Vulnerability Analysis

Overview

SourceCodester Modern Image Gallery App 1.0 contains a path traversal caused by manipulation of the "filename" argument in /delete.php, letting remote attackers access arbitrary files, exploit requires no special privileges.

Severity & Score

Impact

Remote attackers can access arbitrary files, potentially exposing sensitive information or system files.

Mitigation

Update to the latest version or apply patches addressing path traversal in /delete.php.

References

• https://gist.github.com/hackusman/e618b915514ed24b9333c72152bb7218
• https://gist.github.com/hackusman/e618b915514ed24b9333c72152bb7218#-detailed-proof-of-concept-poc
• https://vuldb.com/?ctiid.349641
• https://vuldb.com/?id.349641
• https://vuldb.com/?submit.765591
• https://www.sourcecodester.com/

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner