EventCatalog SDK CVE-2026-116046

Requires the ability to pass an attacker-controlled path value - options.path for getCustomDoc/getCustomDocs, or the directory/file-name arguments for writeCustomDoc/rmCustomDoc - into the vulnerable functions in packages/sdk/src/custom-docs.ts. The pre-2.30.0 code joined these values directly to the catalog docs directory without containment, so '../' sequences, leading-slash/absolute paths, Windows drive-letter or UNC paths, null bytes, or symlinks escape that directory. Exploitation is LIMITED to local-host access (AV:L) by a caller that already has privileges to invoke the SDK (PR:L), which in typical use is a local build/documentation tooling context rather than a network-facing service; there is no remote or unauthenticated path from the available data.

This is a moderate-severity, low-urgency issue rather than a top priority. All impact signals point low: the sole CVSS vector supplied is CVSS:4.0 (base 4.8) with AV:L (local), AC:L, AT:N, PR:L (authenticated/privileged caller), UI:N, and only low confidentiality, integrity and availability impact (VC:L/VI:L/VA:L), with no scope change. There is no EPSS score in the input, this CVE is not on the CISA KEV list, and no public exploit code or working-PoC reference is present - only VulDB advisory pages and the vendor patch/PR/commit/release links. The vuln.today decision label is 'this_month', which is consistent with the low CVSS and absence of exploitation evidence - this is not an act_now or emergency item. The flaw is a genuine path traversal (CWE-22) confirmed by the vendor's own fix, but the local attack vector and the fact that the affected code is a developer SDK (not a network-exposed service) sharply limit real-world risk. No signals conflict; the picture is uniformly low. The only mild caveat is that path traversal enabling writes and deletes outside the docs directory could, in some callers, have higher integrity/availability consequences than the vendor's uniform 'low' rating suggests, but the evidence does not establish a higher impact.

An actor who can supply the options.path (or directory/file name) argument to the EventCatalog SDK's getCustomDoc/writeCustomDoc/rmCustomDoc functions on the local host passes a traversal sequence (e.g. '../', an absolute path, a drive-letter/UNC path, or a path through a symlink) so the read, write, or delete lands outside the intended catalog docs directory. No public exploit code is identified; exploitation requires local access and control of the path argument, consistent with the AV:L/PR:L vector.