EUVD-2026-45994Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Unauthenticated network endpoint with low-complexity traversal (AV:N/AC:L/PR:N/UI:N); read-only .md disclosure gives C:H, no integrity or availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
2DescriptionCVE.org
dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, the documentation and static markdown renderer accepts attacker-controlled path segments and only runs them through the Rails HTML sanitizer, which does not remove directory traversal sequences. An unauthenticated attacker can traverse out of the intended docs or static directories and render arbitrary .md files from the application root or engine root. This is patched in version 26.06.08.
AnalysisAI
Arbitrary file disclosure in dataCycle-CORE (versions up to and including 25.07.3) allows an unauthenticated remote attacker to read arbitrary .md files outside the intended docs/static directories. The documentation and static markdown renderer passes attacker-controlled path segments only through the Rails HTML sanitizer, which does not strip directory-traversal sequences, enabling path traversal to the application or engine root. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the dataCycle documentation or static markdown renderer endpoint (the docs/static routes) be network-reachable to the attacker; no authentication, privileges, or user interaction are needed (PR:N/UI:N), so default-configured internet-facing instances of dataCycle-CORE ≤25.07.3 are exploitable. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5 High) is internally consistent and aligns with the description: network-reachable, low complexity, no privileges, no user interaction, with a pure confidentiality impact (C:H, I:N, A:N) - appropriate for a read-only file-disclosure flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker sends a crafted HTTP request to dataCycle's documentation or static markdown endpoint, inserting '../' sequences into the path segment (e.g., requesting a docs path that traverses up to the application or engine root). The renderer sanitizes the input as HTML but leaves the traversal intact, resolves the path outside docs/static, and returns the rendered contents of an arbitrary .md file. … |
| Remediation | Upgrade dataCycle-CORE to version 26.06.08, which contains the fix (Vendor-released patch: 26.06.08); consult advisory GHSA-gc37-6w59-hj36 at https://github.com/datacycle-engine/dataCycle-CORE/security/advisories/GHSA-gc37-6w59-hj36. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory systems running dataCycle-CORE ≤25.07.3 and assess exposure of sensitive documentation, configuration files, and potential credentials. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Datacycle Core
View allBroken object-level authorization in dataCycle-CORE (versions up to and including 25.07.3) lets any authenticated API us
Broken authorization in dataCycle-CORE (versions up to and including 25.07.3) lets any authenticated low-privileged user
Broken authorization in dataCycle-CORE (versions up to and including 25.07.3) lets any remote, unauthenticated caller do
Account takeover via unthrottled online password guessing affects dataCycle-CORE (versions up to and including 25.07.3),
Open redirect and token-theft in dataCycle-CORE (all versions up to and including 25.07.3) lets a low-privileged authent
Reflected DOM XSS in dataCycle-CORE versions up to and including 25.07.3 allows unauthenticated remote attackers to inje
Improper authorization in dataCycle-CORE versions up to and including 25.07.3 allows any Standard user to enumerate the
Cross-site request forgery in dataCycle-CORE (≤ 25.07.3) enables remote attackers to force authenticated users into unin
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today