This vulnerability exists in yushine InnoShop up to version 0.8.2 in the FileManagerController::destroyFiles function located in innopacks/restapi/routes/panel-api.php. The flaw allows remote attackers to perform path traversal by manipulating file paths, potentially enabling unauthorized file deletion or access. The vendor was notified but did not provide a response or patch. Exploit code is publicly available, increasing the risk of exploitation. No official remediation or patch has been published as of the disclosure date.

Successful exploitation of this path traversal vulnerability could allow an attacker with limited privileges to delete or manipulate files outside the intended directory scope. This could lead to unauthorized file removal or modification, potentially disrupting application functionality or exposing sensitive data. The attack requires no user interaction and can be initiated remotely. However, the vulnerability requires some level of privileges (PR:L) and has limited impact on confidentiality and integrity (VC:N, VI:L, VA:L).

No official fix or patch is currently available from the vendor, and the vendor has not responded to the disclosure. Users should monitor vendor communications for any future updates. Until a patch is released, consider restricting access to the affected FileManagerController::destroyFiles endpoint and applying network-level controls to limit exposure. Review application logs for suspicious activity related to file deletion requests. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.