#LFI — w4nn4d13

Jun 13, 2026

CVE-2026-9506 — Unauthenticated Local File Inclusion (LFI) in Bagisto

Unauthenticated LFI in Bagisto allows arbitrary file read via path traversal without authentication. Disclosed via CERT-In and assigned CVE-2026-9506.

Web Application Security