# CVE-2026-9197: Nextend Smart Slider 3 directory traversal in replaceHTMLImage

Source: https://junglewise.ai/threats/cve-2026-9197-nextend-smart-slider-3-directory-traversal-in-replacehtmlimage  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-06. Updated: 2026-06-06  
License: CC BY 4.0 with a link back

CVE-2026-9197 · Severity: medium · CVSS 4.9 · Published 2026-06-06

Smart Slider 3, a popular WordPress plugin used for creating visual sliders, contains a security flaw that allows high-level administrators to access files they should not be able to see. By exploiting this vulnerability, an attacker with administrative credentials could read sensitive configuration files or other private data stored on the web server. This could lead to further compromise of the website or the underlying server infrastructure.

Technologies: [Nextend Smart Slider 3](https://junglewise.ai/threats/technologies/smart-slider-3). Vendors: [Nextend](https://junglewise.ai/threats/vendors/nextend).

## Quick answers

**Is CVE-2026-9197 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-9197 being exploited in the wild.

**How severe is CVE-2026-9197?** Medium severity, with a CVSS score of 4.9, published 6 June 2026.

**Which products and versions are affected?** Nextend Smart Slider 3 Up to, and including, 3.5.1.36.

**Is there a fix for CVE-2026-9197?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-9197 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-9197?** Check whether you run Nextend Smart Slider 3 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A directory traversal vulnerability (CWE-22) exists in the Smart Slider 3 plugin for WordPress due to insufficient input validation in the 'replaceHTMLImage' function. The flaw is located within the administrative controller and backup export components of the plugin. An authenticated attacker with 'Administrator' or higher privileges can exploit this by submitting crafted requests that use 'dot-dot-slash' (../) sequences to navigate outside the intended directory. This allows for the unauthorized reading of arbitrary files on the server. The vulnerability is addressed in versions following 3.5.1.36.

## Affected products

- Nextend Smart Slider 3 Up to, and including, 3.5.1.36

## Timeline

- 2026-06-06: disclosed
- 2026-06-06: advisory

## References

- [https://plugins.trac.wordpress.org/browser/smart-slider-3/trunk/Nextend/SmartSlider3/Application/Admin/Slider/ControllerSlider.php](https://plugins.trac.wordpress.org/browser/smart-slider-3/trunk/Nextend/SmartSlider3/Application/Admin/Slider/ControllerSlider.php)
- [https://plugins.trac.wordpress.org/browser/smart-slider-3/trunk/Nextend/SmartSlider3/BackupSlider/ExportSlider.php](https://plugins.trac.wordpress.org/browser/smart-slider-3/trunk/Nextend/SmartSlider3/BackupSlider/ExportSlider.php)
- [https://plugins.trac.wordpress.org/browser/smart-slider-3/trunk/Nextend/SmartSlider3/BackupSlider/ExportSlider.php](https://plugins.trac.wordpress.org/browser/smart-slider-3/trunk/Nextend/SmartSlider3/BackupSlider/ExportSlider.php)
- [https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3552076%40smart-slider-3&new=3552076%40smart-slider-3&sfp_email=&sfph_mail=](https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3552076%40smart-slider-3&new=3552076%40smart-slider-3&sfp_email=&sfph_mail=)
- [https://www.wordfence.com/threat-intel/vulnerabilities/id/059c2d6d-1296-4463-96ae-a95ba7dad70a?source=cve](https://www.wordfence.com/threat-intel/vulnerabilities/id/059c2d6d-1296-4463-96ae-a95ba7dad70a?source=cve)

## Related threats

- [Smart Slider 3 stored cross-site scripting in slider block attribute](https://junglewise.ai/threats/cve-2026-15798-smart-slider-3-stored-cross-site-scripting-in-slider-block)