Path traversal via sanitize-filename bypass in SillyTavern extensions API (CVE-2026-44650)

The `POST /api/extensions/delete` endpoint in SillyTavern validates the `extensionName` parameter before sanitizing it, allowing the special value `"."` to pass the non-empty check. The `sanitize-filename` library converts `"."` to an empty string, causing `path.join` to resolve to the base extensions directory itself, which is then recursively deleted. No authentication is required in the default configuration, enabling any user with network access to permanently destroy the entire extensions directory with a single unauthenticated HTTP request. Affected versions: - <= 1.17.0 We recommend updating to: 1.18.0. CVSS 9.1 · our assessment: act_now Reference: https://github.com/SillyTavern/SillyTavern/security/advisories/GHSA-886q-f44j-h6wh Details: https://vuln.today/cve/CVE-2026-44650