Open-source package vulnerability · Maven
CVE-2026-36767: Shopizer has a path traversal issue
criticalCVSS 3.1 10.0GHSA-f5w4-7ccj-5m75
A path traversal vulnerability in the /content/images/add endpoint of shopizer through version 3.2.5 allows attackers write arbitrary files to any writeable path via a crafted POST request.
Published Apr 30, 2026 · Updated May 7, 2026
Affected packages
com.shopizer:shopizer
- Ecosystem
- Maven
- Affected
- <= 2.16.0
- Fixed in
- No patched version yet
- Check
mvn dependency:tree -Dincludes=com.shopizer:shopizer
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
A path traversal vulnerability in the /content/images/add endpoint of shopizer through version 3.2.5 allows attackers write arbitrary files to any writeable path via a crafted POST request.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology