A vulnerability was detected in yaojingang GEOFlow up to 2.1.0. (CVE-2026-82665)

CVE-2026-82665 is a path traversal vulnerability in the unlink function of app/Http/Controllers/Admin/ImageLibraryController.php in yaojingang GEOFlow versions up to 2.1.0. The vulnerability arises from improper validation of the file_path argument, allowing an attacker with high privileges to perform path traversal attacks remotely. The vulnerability has a CVSS 3.1 base score of 3.8 (low severity) with network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, no confidentiality impact, low integrity impact, and low availability impact. The issue is fixed in version 2.1.1, with the patch identified by commit 67abfd864a15d169a78429f3290c91cb3b93e849.

The vulnerability allows an attacker with high privileges to perform path traversal via the file_path argument, potentially leading to limited integrity and availability impact by unlinking unintended files. There is no confidentiality impact. The attack requires network access and high privileges, limiting the attack surface.

Upgrade yaojingang GEOFlow to version 2.1.1 or later, which contains the official fix for this vulnerability. No other mitigation is indicated or required.