CVE-2026-108591 — Vulnerability intelligence
innocommerce — InnoShop
Published:
- CVSS
- 5.9
- CISA KEV
- Not listed; not proof of no exploitation
Original source text (not a translation)
InnoShop 0.9.2 contains a local file disclosure vulnerability that allows authenticated administrators with files_create permission to read server files by abusing the AI Core MCP file_upload tool's source argument. Attackers can supply file:// or php:// stream wrappers passed to file_get_contents(), storing contents on the public media disk to expose the .env file with APP_KEY and database credentials.