CVE-2026-103896: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in 10web 10Web Booster – Website speed optimization, Cache & Page Speed optimizer

CVE-2026-103896 is a path traversal vulnerability in the 10Web Booster plugin for WordPress versions up to 2.34.5. The function OptimizerWebPageCache::get_cache_file_dir() concatenates unsanitized $_GET parameters into cache file paths, and the cache_content() function performs mkdir() and file_put_contents() calls without verifying that the resulting path is within the cache root directory. This allows unauthenticated attackers to create arbitrary directories with mode 0777 recursively outside the cache root and write a cached page named 'source.html' containing the rendered page buffer. The vulnerability does not permit writing PHP files or code execution, limiting the impact to cache poisoning and arbitrary directory creation.

An unauthenticated attacker can create arbitrary directories outside the intended cache directory and write a cached page file named 'source.html' into those directories. This can lead to cache poisoning and unauthorized directory creation with full permissions (0777). However, the attacker cannot execute arbitrary code because the file content is limited to the rendered page buffer and the filename extension is fixed, preventing PHP file creation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, monitor for unusual directory creation outside the cache root and consider restricting web server permissions to limit directory creation. Avoid exposing the vulnerable plugin to untrusted users if possible.