Bisheng CVE-2026-51860

Exploitation requires network reachability to a bisheng 2.3.0, 2.4.0, or 2.4.0-beta1 instance exposing the endpoint backed by src/backend/bisheng/linsight/domain/task_exec.py; per CVSS PR:N/UI:N no authentication or user interaction is needed against default configurations. The practical limiting factors are deployment scope and exposure: bisheng is a niche self-hosted LLM platform, so risk is concentrated in organizations that run it and especially those exposing it to untrusted networks; instances behind authentication proxies, network segmentation, or not internet-facing substantially reduce real-world reachability. Impact is bounded to file disclosure (C:H, I:N, A:N) - no code execution or modification is implied by the data.

Signals are mixed and point to moderate, not critical, priority. The CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N) reflects an unauthenticated, network-reachable, low-complexity path traversal, and the impact profile (C:H/I:N/A:N) correctly captures a read-only information-disclosure flaw - arbitrary file read with no integrity or availability impact. SSVC reinforces concern on the exploit side: Exploitation=poc (exploit code demonstrated, not active exploitation), Automatable=yes (traversal attacks are trivially scriptable), and Technical Impact=partial (consistent with read-only disclosure rather than full compromise). Countering this, EPSS is only 0.33% (24th percentile), indicating low modeled probability of exploitation in the next 30 days, and the CVE is NOT in CISA KEV. The gap between a demonstrated POC/'automatable' rating and a low EPSS is best explained by bisheng's limited deployment footprint - exploitability is high per-instance but the population of exposed targets is small, so mass exploitation is unlikely. Net: a genuine, easily-exploited vulnerability for anyone running affected bisheng versions, but a lower enterprise-wide priority than the 7.5 alone suggests. Note the CPE and affected-version data are placeholder 'n/a' values, so machine-driven asset matching will fail and affected scope must be taken from the description (2.3.0, 2.4.0, 2.4.0-beta1) rather than the structured feed.

An unauthenticated attacker sends a crafted request to an internet-exposed bisheng instance, embedding directory-traversal sequences (e.g. ../) in a path parameter handled by linsight/domain/task_exec.py, causing the server to read and return files outside the intended directory. A public proof-of-concept exists (referenced gist), and because the flaw is low-complexity and automatable, the attacker can script retrieval of sensitive files such as configuration, credentials, or model/data artifacts. No authentication or user interaction is required.