EUVD-2026-33061
GHSA-93rg-qjp9-mg35
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible, low complexity attack; no privileges or user interaction; file read only, high confidentiality impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
8DescriptionCVE.org
Usagi-org ai-goofish-monitor contains an unauthenticated arbitrary file read vulnerability in the GET /api/prompts/{filename} endpoint on Windows deployments that allows unauthenticated remote attackers to read arbitrary files by supplying absolute Windows paths or backslash-based traversal sequences. Attackers can bypass the incomplete path traversal guard, which only blocks forward slashes and '..', by providing absolute paths such as Windows system file locations, causing os.path.join to discard the intended prompts directory prefix and expose files accessible to the application process.
AnalysisAI
Unauthenticated arbitrary file read in Usagi-org Ai Goofish Monitor on Windows deployments allows remote attackers to read arbitrary files by supplying absolute Windows paths or backslash-based traversal sequences to the /api/prompts/{filename} endpoint. The vulnerability, tracked as CVE-2026-10044, bypasses an incomplete path sanitisation guard that only blocks forward slashes and dot-dot sequences, enabling attackers to access sensitive files such as system configuration files. A publicly available proof-of-concept exists, but the EPSS score is low (0.05%) and there is no evidence of active exploitation at the time of analysis.
Technical ContextAI
The root cause is an absolute path traversal (CWE-36) in the Python prompts API route. The application uses os.path.join('prompts', filename) to construct the file path, but on Windows systems, if filename is an absolute path (e.g., C:\Windows\win.ini) or contains backslash traversal (..\..\), os.path.join discards the 'prompts' prefix and uses the attacker-supplied path. The fix replaces the custom sanitisation with a resolve-and-containment check using pathlib.Path, which blocks any path that escapes the intended prompts directory. The CPE cpe:2.3:a:usagi-org:ai-goofish-monitor:*:*:*:*:*:*:*:* indicates the affected product, and the issue was disclosed via VulnCheck advisory and GitHub issue #488.
RemediationAI
Upgrade to a version of Ai Goofish Monitor that includes the fix from commit f85d140b6b45029d9a0925feb96dad733b41396d or apply the patch from PR #489 manually. The fix replaces the vulnerable os.path.join logic with a safe pathlib.Path containment check. If immediate patching is not possible, restrict network access to the /api/prompts endpoint using a reverse proxy or firewall to only allow trusted sources, or disable the affected feature if not required. Note that these workarounds do not eliminate the underlying vulnerability and may disrupt legitimate use of the prompts API.
Same weakness CWE-36 – Absolute Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today