TaskingAI CVE-2026-51906

Exploitation requires the DALL-E 3 image generation tool to be enabled and configured (with valid image-generation API credentials) within TaskingAI v0.3.0, and the attacker must be able to invoke that tool and control the project_id parameter passed to save_url_image. The attacker supplies traversal sequences in project_id to redirect the written image outside the intended project directory. Limiting factors: the write content is an image file whose bytes are only partially attacker-controlled, so escalation to code execution depends on a writable web root or overwriting an executable/config/startup path; the DALL-E 3 tool must be active; and the issue is pinned to v0.3.0. Despite the vector's PR:N, invoking the tool pipeline realistically implies application-level access rather than fully anonymous exploitation - verify with vendor.

Signals conflict, and the gap matters. The input CVSS is 9.1 Critical with AV:N/AC:L/PR:N/UI:N/C:H/I:H, which paints a remote, unauthenticated, high-confidentiality-and-integrity picture. But the description is a path-traversal (CWE-22) arbitrary file WRITE in the DALL-E 3 save_url_image routine - a write primitive, not a read primitive, so the C:H rating is hard to justify and appears inflated (verify confidentiality impact with vendor). PR:N is also questionable: the DALL-E 3 tool must be invoked through TaskingAI's assistant/tool-calling feature with a configured image-generation API key, which in most deployments implies some level of application access rather than fully anonymous reach. Exploitation-probability signals all point LOW: EPSS is 0.14% (3rd percentile), there is no CISA KEV listing, and no explicit POC flag is set in the input (though a referenced researcher gist may document the technique). Net assessment: this is a genuine, realistically exploitable arbitrary-file-write bug that can escalate to code execution if images land in a web root or executable/config path, but it is NOT a mass-exploitation emergency - it affects a niche, emerging product, has no evidence of in-the-wild use, and the headline 9.1 overstates real-world risk. Prioritize patching for anyone running TaskingAI v0.3.0 with the DALL-E 3 tool enabled; treat it as medium-high operationally rather than critical.

An attacker able to invoke TaskingAI's DALL-E 3 image generation tool calls save_url_image with a project_id containing directory-traversal sequences (e.g. ../../), causing the downloaded image to be written outside the intended project directory to an arbitrary server path such as the web root or a startup/config location. By overwriting a sensitive file or dropping a crafted payload into an executable path, the attacker can corrupt data or potentially achieve code execution. A gist referenced in the advisory appears to document the technique, though a formal POC is not confirmed in the input.