CVE-2026-108591 — InnoShop 0.9.2 Local File Disclosure via AI Core MCP file_upload Tool
InnoShop 0.9.2 contains a local file disclosure vulnerability that allows authenticated administrators with files_create permission to read server files by abusing the AI Core M…
Published: 2026-10-10 · CVSS: 5.9 · CVSS 4.0
InnoShop 0.9.2 contains a local file disclosure vulnerability that allows authenticated administrators with files_create permission to read server files by abusing the AI Core MCP file_upload tool's source argument. Attackers can supply file:// or php:// stream wrappers passed to file_get_contents(), storing contents on the public media disk to expose the .env file with APP_KEY and database credentials.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7