Read the docs
TI-2026-80040 Aliases CVE-2026-113491GHSA-54m2-gc24-q2f7

Path traversal in GeoDirectory plugin lets users read and delete files

Priority LOW 28CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.

Summary

The GeoDirectory WordPress plugin before 2.8.194 does not validate a user-supplied image URL before using it as a local file path when saving a front-end listing (CWE-22). An attacker with Subscriber-level access or higher can read files outside the web root and delete files on the server, limited to file names with an allowed media extension. A disclosed file is republished at a public URL, and its original is deleted as a side effect. An exploit is linked in the references.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

The GeoDirectory WordPress plugin before 2.8.194 does not validate a user-supplied image URL before using it as a local file path when saving a front-end listing, allowing users with Subscriber-level access and above to read files from outside the web root and to delete files on the server, limited to file names that carry an allowed media extension. A disclosed file is re-published at a public URL and its original is deleted as a side effect.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00249 16th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed GeoDirectory (Unknown): 2.8.194

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownGeoDirectorybefore 2.8.1942.8.194Patch availableCNA
  • GeoDirectory VendorUnknown Affected before 2.8.194 Fixed in 2.8.194 Patch available CNA

Remediation

Upgrade GeoDirectory to version 2.8.194, the fixed version.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA GeoDirectory (Unknown) Fixed in 2.8.194

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    GeoDirectory 2.8.194

    7 records Highest priority Priority LOW 7 LOW

    Other records, highest priority first

    • TI-2026-80043 Code injection in GeoDirectory WordPress plugin lets admins run codePriority LOW 35
    • TI-2026-80042 Stored XSS in GeoDirectory gd_map shortcode width attributePriority LOW 32
    • TI-2026-80041 Unauthenticated disclosure of non-public listings in GeoDirectoryPriority LOW 30
    Show all 7 records →

Timeline

  1. 2026-10-24 Threatist record created from CVE-2026-113491
  2. 2026-10-24 Alias added: GHSA-54m2-gc24-q2f7
  3. 2026-10-24 CVSS score added · CISA ADP
  4. 2026-10-24 Weakness changed · CISA ADP
  5. 2026-10-24 CISA SSVC decision points changed

References

Exploit 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences