CVE-2026-108591: Innocommerce Innoshop

Medium severity, CVSS 4.4.

InnoShop 0.9.2 contains a local file disclosure vulnerability that allows authenticated administrators with files_create permission to read server files by abusing the AI Core MCP file_upload tool's source argument. Attackers can supply file:// or php:// stream wrappers passed to file_get_contents(), storing contents on the public media disk to expose the .env file with APP_KEY and database credentials.

Affected products

• Innocommerce Innoshop: from 0.9.2, up to and including 0.9.2

Published 2026-10-10. Last modified 2026-10-10.