infinite-image-browsing vulnerabilities

2 known vulnerabilities in infinite-image-browsing from Zanllp. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  infinite-image-browsing: Improper Link Resolution Before File Access

  CVE-2026-77815Aug 21, 2026Zanllp

  to_abs_path in scripts/iib/tool.py normalised the requested path with os.path.normpath, which collapses dot segments but does not resolve symbolic links. A symlink placed inside a scanned directory therefore satisfies the containment comparison performed by is

• 7.5 High severity

  infinite-image-browsing: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-77814Aug 21, 2026Zanllp

  is_path_trusted in scripts/iib/api.py compares the requested path against each allowed parent directory with path.startswith(parent_path), without appending a path separator. A directory whose name merely begins with an allowed path therefore satisfies the com