Executive brief
GEOFlow is an open-source content management and distribution platform. A path traversal vulnerability in the image library cleanup function allows remote attackers to delete or manipulate files outside the intended directory through a malicious file_path parameter, potentially leading to data loss or system compromise.
Technical details
A path traversal vulnerability exists in the unlink() function of app/Http/Controllers/Admin/ImageLibraryController.php in GEOFlow versions up to 2.1.0. The vulnerability arises from insufficient input validation on the file_path parameter, allowing an attacker to manipulate path traversal sequences (e.g., ../) to access and delete files outside the intended image library directory. The attack is remotely exploitable and may not require authentication depending on access controls. An attacker can achieve arbitrary file deletion on the server. The vulnerability was patched in version 2.1.1 (commit 67abfd864a15d169a78429f3290c91cb3b93e849), and users should upgrade immediately.
Affected products
- yaojingang GEOFlow up to 2.1.0
Timeline
- 2026-08-31: disclosed
- 2026-07-17: patched: Fix available in version 2.1.1