Executive brief
novaGallery is a PHP-based image gallery application used to host and display photo albums. A security flaw allows unauthorized individuals to bypass directory restrictions and view images stored outside the designated gallery folder. This could lead to the exposure of private photos, scans, or sensitive screenshots stored elsewhere on the server's filesystem.
Technical details
A path traversal vulnerability exists in the album and cached image routes of novaGallery due to insufficient input sanitization. The application attempts to filter traversal attempts by removing the literal string '/../', but this can be bypassed using URL encoding (e.g., %2e%2e) or other variations. An unauthenticated attacker can craft requests to the '/album/' or '/storage/cache/' endpoints to browse directories and retrieve files outside the 'galleries/' root. While the impact is limited to files that the application's image processing library can parse as images, it allows for unauthorized disclosure of sensitive media files on the host filesystem. The issue is fixed in version 2.1.1 by implementing more robust path normalization and validation.
Affected products
- novafacile novaGallery <= 2.1.0
Timeline
- 2026-04-19: patched: Version 2.1.1 released to address the vulnerability.
- 2026-05-08: disclosed: Public advisory and CVE-2026-42028 published.