Ai-doctor CVE-2026-19326

Q: What is the CVSS score of CVE-2026-19326?

CVE-2026-19326 has a CVSS 4.0 base score of 1.9 (Low). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-54853 LOW

Path Traversal (CWE-22)

2026-08-09 VulDB

GHSA-rhch-h3c6-w784

Path Traversal Ai Doctor

1.9

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

1.9 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.4 MEDIUM

Local vector with low privileges required to reach the API; impact limited to file deletion affecting integrity and availability only, with no confidentiality breach.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Aug 09, 2026 - 03:22 NVD

MEDIUM LOW

CVSS changed

Aug 09, 2026 - 03:22 NVD

4.8 (MEDIUM) 1.9 (LOW)

Analysis Generated

Aug 09, 2026 - 02:42 vuln.today

DescriptionCVE.org

A vulnerability was detected in Jevon-Zhong Ai-doctor 0.0.1. This vulnerability affects the function deleteImage of the file ai-doctor-server/src/filemanagement/filemanagement.service.ts. Performing a manipulation of the argument imagePath results in path traversal. The attack must be initiated from a local position. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Path traversal in Jevon-Zhong Ai-doctor 0.0.1 allows local low-privilege users to manipulate the imagePath argument of the deleteImage function to escape the intended image directory and delete arbitrary files accessible to the server process. The attack vector is strictly local (AV:L, PR:L), and publicly available exploit code exists (CVSS 4.0 E:P). No vendor patch has been issued and the project has not responded to the disclosure report filed via GitHub.

Technical ContextAI

Ai-doctor is a Node.js/TypeScript application; the vulnerable component is the deleteImage function in ai-doctor-server/src/filemanagement/filemanagement.service.ts, a server-side file management service. CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) identifies the root cause: the imagePath argument is not sanitized or validated before being used in a filesystem deletion operation, permitting sequences such as ../../ to traverse outside the intended image storage directory. CPE cpe:2.3:a:jevon-zhong:ai-doctor:*:*:*:*:*:*:*:* uses a wildcard version component, indicating NVD considers all known versions potentially affected, though only version 0.0.1 is explicitly described in the disclosure.

RemediationAI

No vendor-released patch has been identified at time of analysis; the project maintainer has not responded to the GitHub issue report (https://github.com/Jevon-Zhong/Ai-doctor/issues/1). As a compensating control, administrators should restrict local system access to only fully trusted users, ensuring no low-privilege accounts can invoke the deleteImage API endpoint. A direct code-level workaround is to add input validation in filemanagement.service.ts that rejects any imagePath containing .. sequences or absolute path prefixes before passing the argument to the filesystem operation - this eliminates the traversal vector without requiring broader architectural changes. Additionally, running the Ai-doctor server process under a dedicated, minimally privileged OS account limits the set of files that can be deleted even if exploitation occurs. Monitor the upstream repository for any maintainer response or patch release.