CVE-2019-5887

7.5 highEPSS 1.5%

An issue was discovered in ShopXO 1.2.0. In the UnlinkDir method of the FileUtil.php file, the input parameters are not checked, resulting in input mishandling by the rmdir method. Attackers can delete arbitrary files by using "../" directory traversal.

Severity

CVSS 3.0

7.5 high

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS: 1.5% chance of exploitation in the next 30 days; higher than 74% of CVEs (scores of 2026-10-31)
CWE: CWE-22
Published: 2019-01-10
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

shopxo:shopxo

References

https://github.com/gongfuxiang/shopxo/issues/2
https://github.com/gongfuxiang/shopxo/issues/2

Check your stack JSON