Medium severity · published Oct 26, 2026
CVE-2026-116223
icret EasyImage del.php privileges management
New
6.5
CVSS
0.3%
EPSS
No
On KEV
Description
A flaw has been found in icret EasyImage up to 2.8.7. The impacted element is an unknown function of the file app/del.php. Executing a manipulation of the argument hash can lead to improper privilege management. The attack can be launched remotely. The exploit has been published and may be used. This patch is called b12cb67d447bcbb67e21c8f011d0f5638229760c. A patch should be applied to remediate this issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 27% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EA
EasyImage · icret
2.8.0; 2.8.1; 2.8.2; 2.8.3; 2.8.4; 2.8.5; +2 more · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-116223
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-116223
gist.github.com
https://gist.github.com/yyz8097/bc58546872ad90208d2b35260d84b1d9
github.com
https://github.com/icret/EasyImages2.0/commit/b12cb67d447bcbb67e21c8f011d0f5638229760c
github.com
https://github.com/icret/EasyImages2.0/issues/283
vuldb.com
https://vuldb.com/cve/CVE-2026-116223
vuldb.com
https://vuldb.com/submit/1004976
vuldb.com
https://vuldb.com/vuln/426203