CVE-2026-25869 — HIGH (7.5)

Q: How severe is CVE-2026-25869?

CVE-2026-25869 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.

Q: Is there a patch for CVE-2026-25869?

Check the references section above for vendor advisories and patch information. Affected products include: Rybber Minigal Nano.

Vulnerability Description

MiniGal Nano versions 0.3.5 and prior contain a path traversal vulnerability in index.php via the dir parameter. The application appends user-controlled input to the photos directory and attempts to prevent traversal by removing dot-dot sequences, but this protection can be bypassed using crafted directory patterns. An attacker can exploit this behavior to cause the application to enumerate and display image files from unintended filesystem locations that are readable by the web server, resulting in unintended information disclosure.

CVSS Score

7.5

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

NONE

Availability

NONE

Affected Products

Vendor	Product	Versions
Rybber	Minigal Nano	<= 0.3.5

Related Weaknesses (CWE)

CWE-22

References

FAQ

What is CVE-2026-25869?

CVE-2026-25869 is a vulnerability with a CVSS score of 7.5 (HIGH). MiniGal Nano versions 0.3.5 and prior contain a path traversal vulnerability in index.php via the dir parameter. The application appends user-controlled input to the photos directory and attempts to p...

How severe is CVE-2026-25869?

CVE-2026-25869 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-25869?

Check the references section above for vendor advisories and patch information. Affected products include: Rybber Minigal Nano.