medium

CVE-2026-111956

WholesaleX leaves the user-import file it wrote in a publicly readable location under a predictable name, so anyone can download the imported customer list

Severity: medium
Affected product: wholesalex
Affected versions: wholesalex < 3.0.9
Fixed in: wholesalex 3.0.9
Detection basis: Component version range
Shipped rule: wholesalex: WholesaleX leaves the user-import file it wrote in a publicly readable location under a predictable name, so anyone can download the imported customer list
Added to NewScan: 2026-10-21
Detected by: NewScan — free, self-hosted

How NewScan reports it

COMPONENT VERSION RANGE

NewScan fingerprints wholesalex from its response and reports this CVE when the detected version falls inside the affected range below.

References

NVD — CVE-2026-111956 ↗
CVE Record ↗

Scan for this yourself — local, in-band scanning is free.

Get NewScan (FREE) →

Review the measured benchmark, then use the verified remediation process.