ekko-studio CVE-2026-114379

Exploitation requires an authenticated low-privilege account on an ekko-studio instance (≤1.0.6) and the ability to reach the Media Generation API endpoint backed by the saveGeneratedImages function (packages/server/src/modules/studio/controllers/media.ts). The specific trigger is supplying an attacker-controlled output_path argument to that image-generation request; the patch evidence shows this 'request custom image/video output path' capability was available to ordinary users and is removed by the fix. Limiting factors: valid authentication is required (PR:L, so not exploitable by fully anonymous attackers), the instance must expose the Media Generation API, and impact is bounded to limited file integrity/availability effects with no confidentiality disclosure per the authoritative vector.

This is a medium-severity (CVSS 4.0 base 5.3) path-control flaw (CWE-73, External Control of File Name or Path) that is a low-to-moderate priority, not a top-tier emergency. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L) indicates network-reachable, low-complexity exploitation but requires authenticated low-privilege access (PR:L) and yields only limited integrity and availability impact with NO confidentiality impact (VC:N). There is no EPSS score provided, no CISA KEV listing, and no public exploit identified at time of analysis - so there is no evidence of active exploitation; the requirement for prior authentication plus the low technical impact meaningfully constrains real-world risk. One signal conflicts with the data: the 'Information Disclosure' tag implies confidentiality exposure, yet the authoritative CVSS vector explicitly sets VC:N, so the issue is better characterized as unauthorized file write/inclusion affecting integrity and availability rather than data leakage - verify the actual impact against the patch behavior. The GitHub source evidence corroborates the authentication requirement: the fix prevents ordinary users from requesting custom image/video output paths, consistent with PR:L.

An authenticated low-privilege user of ekko-studio invokes the Media Generation API's saveGeneratedImages function and supplies a crafted output_path argument, causing a file to be written to or included from a location outside the intended managed image storage directory. No public exploit code exists; exploitation requires a valid (even low-privilege) account on the target instance.