What is the CVSS score of CVE-2026-30351?

CVE-2026-30351 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of autocoder are affected by CVE-2026-30351?

leonvanzyl autocoder contains an unauthenticated file-disclosure vulnerability allowing remote attackers to retrieve files outside the intended directory structure.

How to fix or mitigate CVE-2026-30351?

Within 24 hours: inventory all systems running leonvanzyl autocoder and identify which expose the static file serving component. Within 7 days: deploy compensating controls including Web Application Firewall rules to block directory-traversal sequences, restrict the service's filesystem permissions to directories necessary for operation only, and segment network access to minimize exposure. Within 30 days: coordinate with development teams to evaluate patched versions or migration to an alternative autocoder with vendor security support.

autocoder CVE-2026-30351

EUVD-2026-25862 HIGH

Path Traversal (CWE-22)

2026-04-27 mitre

Path Traversal N A

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Remote, low-complexity, unauthenticated URL-based path traversal yielding arbitrary file read (C:H) with no integrity or availability impact and no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 02:08 vuln.today

CVSS changed

Apr 27, 2026 - 16:22 NVD

7.5 (HIGH)

EUVD ID Assigned

Apr 27, 2026 - 15:30 euvd

EUVD-2026-25862

CVE Published

Apr 27, 2026 - 00:00 nvd

HIGH 7.5

DescriptionCVE.org

A path traversal vulnerability in the UI/static component of leonvanzyl autocoder commit 79d02a allows attackers to read arbitrary files via sending crafted URL path containing traversal sequences.

AnalysisAI

Arbitrary file read in leonvanzyl autocoder (commit 79d02a) lets remote unauthenticated attackers retrieve files outside the intended web root by embedding directory-traversal sequences in URL paths served by the UI/static file component. The flaw carries CVSS 7.5 (confidentiality-only impact) and is trivially automatable, but EPSS is negligible (0.01%, 3rd percentile) and there is no public exploit identified at time of analysis. A second reference (a syphonetic gist) may contain proof-of-concept detail, though its contents are not confirmed from the provided data.

Technical ContextAI

autocoder is a small, individually-maintained project on GitHub (leonvanzyl/autocoder), identified here by a specific commit hash (79d02a) rather than a tagged release, indicating pre-release/rolling development software. The vulnerability lives in the component that serves static/UI assets. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, i.e., path traversal): the static-file handler concatenates attacker-controlled URL path segments onto a base directory without canonicalizing or validating them, so sequences like ../ resolve outside the web root and allow reading arbitrary files (source code, configuration, secrets/tokens, or system files such as /etc/passwd) that the server process can access. CPE data is unhelpful here (listed as n/a:n/a), so the affected surface is defined by the repository and commit rather than a formal product enumeration.

RemediationAI

No vendor-released patch identified at time of analysis and no fix version is provided in the input, so upgrading to a fixed release is not currently an option. Monitor the upstream repository (https://github.com/leonvanzyl/autocoder) for a commit that adds path canonicalization to the static-file handler and update once available. As compensating controls: place the service behind a reverse proxy or WAF rule that rejects requests whose decoded path contains traversal sequences (../, ..%2f, encoded/double-encoded variants) - trade-off is that overly strict rules can break legitimate encoded paths; restrict network exposure so the UI/static endpoint is not internet-reachable (bind to localhost or an internal segment) - trade-off is reduced remote accessibility for legitimate users; and run the server process under a low-privilege account confined with a chroot/container and minimal filesystem access so a successful traversal exposes as little as possible - trade-off is added deployment complexity. Rotate any secrets/tokens that may have been readable via the affected file paths.