Bagisto Path Traversal Vulnerability in ImageCacheController Component Allowing Arbitrary File Read

A path traversal vulnerability has been identified in Bagisto version 2.4.1. This issue arises from inadequate validation of user input in the ImageCacheController component. An unauthenticated remote attacker could exploit this vulnerability by sending crafted path traversal sequences through the filename parameter, potentially accessing sensitive files outside the intended directory on the targeted system. Successful exploitation could lead to the unauthorized reading of arbitrary files, including application configuration files, database credentials, API keys, and other sensitive information.

Impact

Exploitation of this vulnerability could result in the unauthorized disclosure of sensitive files on the affected system, including application configurations and credentials.

Remediation

Users are advised to upgrade Bagisto to version 2.4.2 or later.