CVE-2021-24363: Photo Gallery < 1.5.75 - File Upload Path Traversal

Severity: medium (CVSS 4.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-08-16 · updated 2026-06-17
Weakness: CWE-22

Description

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin before 1.5.75 did not ensure that uploaded files are kept inside its uploads folder, allowing high privilege users to put images/SVG anywhere in the filesystem via a path traversal vector

Affected products

10web Photo Gallery by 10Web – Mobile-Friendly Image Gallery: before 1.5.75 — fixed in 1.5.75

How to fix

Upgrade to a fixed version: 10web Photo Gallery by 10Web – Mobile-Friendly Image Gallery 1.5.75. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/1628935f-1d7d-4609-b7a9-e5526499c974
https://wpscan.com/vulnerability/1628935f-1d7d-4609-b7a9-e5526499c974

Get alerted when CVE-2021-24363 or the next vulnerability affects your stack