Path Traversal in Link Library
CVE-2026-78394
The Link Library WordPress plugin before 7.9.6 does not sanitize a user-supplied destination folder before writing a generated image to disk, allowing users with the Contributor role and above to create directories and write or overwrite image files anywhere the web server can write, including outside the site's document root. The written file name is always numeric with a fixed image extension, so executable code cannot be planted this way.
Vulnerability class: Path Traversal (Directory Traversal)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 4.1 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:N.
EPSS exploit prediction
EPSS: 0.002 (4.1th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 4th percentile — 4.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
The 30-day trend appears once there are two daily scores.
Affected products
- Link Library
Weakness classification (CWE)
References
- wpscan.com/vulnerability/9da07b4f-5332-4ba5-8a34-6f2ed303b62c/ (technical-description, exploit, vdb-entry)
Frequently asked questions
- What is CVE-2026-78394?
- CVE-2026-78394 is a medium-severity vulnerability in Link Library, classified under Path Traversal. CVSS score: 4.1/10. Published 2026-09-25.
- How severe is CVE-2026-78394?
- Medium severity. CVSS v3 base score is 4.1 out of 10.