CVE-2026-108591 innocommerce CVE debrief

Who should care

Administrators and security teams responsible for InnoShop 0.9.2 installations should assess exposure and verify inventory. They should also monitor for potential file disclosure attempts and review compensating controls for exposed systems while remediation is scheduled and verified.

Why it matters

CVE-2026-108591 is a local file disclosure vulnerability in InnoShop 0.9.2 that allows authenticated administrators to read server files. Defenders should assess exposure, verify inventory, and monitor for potential file disclosure attempts.

• Potential exposure of sensitive files
• Possible disclosure of .env file with APP_KEY and database credentials
• Verification of inventory and monitoring for potential file disclosure attempts

Technical summary

InnoShop 0.9.2 contains a local file disclosure vulnerability via AI Core MCP file_upload tool, allowing authenticated administrators with files_create permission to read server files by abusing the source argument. The vulnerability can be exploited by supplying file:// or php:// stream wrappers passed to file_get_contents(), storing contents on the public media disk to expose the .env file with APP_KEY and database credentials. The vulnerability has a CVSS score of 5.9 and a severity of MEDIUM. Defenders should assess exposure, verify inventory, and monitor for potential file disclosure attempts.

Defensive priority

Assess exposure, verify inventory, and monitor for potential file disclosure.

Recommended defensive actions

• Assess exposure of InnoShop 0.9.2 installations
• Verify inventory of affected systems
• Monitor for potential file disclosure attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the local file disclosure vulnerability in InnoShop 0.9.2. The vulnerability is caused by the AI Core MCP file_upload tool's source argument, which allows authenticated administrators to read server files. The vulnerability can be exploited by supplying file:// or php:// stream wrappers passed to file_get_contents(), storing contents on the public media disk to expose the .env file with APP_KEY and database credentials. The vulnerability has a CVSS score of 5.9 and a severity of MEDIUM.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.