What’s Vulnerable › Vulnerabilities

CVE-2026-42028: novaGallery: Unauthenticated Path Traversal in Album and Cached Image Routes Allows Reading Images Outside Gallery Root

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-05-08 · updated 2026-10-26
• Weakness: CWE-22

Description

novaGallery is a php image gallery. Prior to version 2.1.1, a path traversal vulnerability has been identified in novaGallery. This allows unauthenticated users to read image files outside the intended gallery root directory. This issue has been patched in version 2.1.1.

Affected products

• novafacile novagallery: before 2.1.1

References

• https://github.com/novafacile/novagallery/commit/46fe7b0f79f429e18c8cff3f92360c4513732ba6
• https://github.com/novafacile/novagallery/releases/tag/v2.1.1
• https://github.com/novafacile/novagallery/security/advisories/GHSA-wv5j-98c7-frm9
• https://github.com/novafacile/novagallery/security/advisories/GHSA-wv5j-98c7-frm9

Get alerted when CVE-2026-42028 or the next vulnerability affects your stack