CVE-2025-52922: Directory Traversal in InnoShop

The directory traversal vulnerability in InnoShop presents a significant security risk. An attacker who can authenticate as an administrator can leverage the /api/file_manager endpoints to perform a wide range of malicious actions. They can map the entire filesystem structure, create arbitrary directories, read sensitive files by copying them to accessible locations, and even delete files. This could lead to complete compromise of the server, including data exfiltration, code execution, and denial of service. The ability to map the filesystem provides reconnaissance capabilities, allowing an attacker to identify valuable targets for further exploitation.

1. Reserved2025-06-21
2. Published2025-06-23
3. EPSS updated2026-03-23

The primary mitigation for CVE-2025-52922 is to upgrade InnoShop to version 0.4.2 or later, which contains the fix. If upgrading immediately is not possible, consider implementing temporary workarounds. Restrict access to the /api/filemanager endpoints to only authorized users and implement strict input validation to prevent directory traversal attempts. Web application firewalls (WAFs) can be configured to block requests containing suspicious path traversal patterns, such as ../. Monitor access logs for unusual activity related to the /api/filemanager endpoints.