EUVD-2026-30764
GHSA-qwrp-wghp-94q2
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Remote unauthenticated upload with attacker-controlled path (AV:N/AC:L/PR:N/UI:N); arbitrary file write yields high integrity and availability impact but no direct read, so C:N.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
SGLangs multimodal generation runtime is vulnerable to an unauthenticated path traversal vulnerability, allowing an attacker to write arbitrary files anywhere the server process has write access, by including ../ sequences in the upload filename when sent to specific endpoints.
AnalysisAI
Arbitrary file write in SGLang's multimodal generation runtime (version 5.10) allows a remote, unauthenticated attacker to place files anywhere the server process can write by embedding ../ sequences in an upload filename sent to specific endpoints. Because the affected process typically runs LLM inference workloads, a written file can be leveraged toward code execution or service disruption. A public technical write-up describing multiple SGLang RCEs exists, though the EPSS probability is very low (0.07%) and the issue is not listed in CISA KEV.
Technical ContextAI
SGLang is a high-performance serving/inference runtime for large language and multimodal models, exposing HTTP endpoints that accept uploads (including multimodal media used for generation). The flaw is CWE-35 (Relative Path Traversal): the upload handler uses the client-supplied filename without canonicalizing or constraining it to a base directory, so ../ traversal sequences escape the intended upload location. This lets the attacker control the destination path of written content rather than the intended sandbox, converting a file-receive feature into an arbitrary-write primitive under the privileges of the serving process.
RemediationAI
No vendor-released patch version is identified at time of analysis, so no exact fix version can be cited from the input data - monitor the SGLang GitHub project (https://github.com/sgl-project/sglang) and the NVD/EUVD advisories (https://nvd.nist.gov/vuln/detail/CVE-2026-7302) for a patched release and upgrade past 5.10 as soon as one is published. As compensating controls until then: do not expose the SGLang HTTP API to untrusted networks - bind it to localhost or place it behind an authenticating reverse proxy and network ACLs so the upload endpoints cannot be reached unauthenticated; restrict the OS user running the server to a minimal, non-writable filesystem layout (read-only application and library directories, uploads confined to a dedicated tmpfs/mount) so traversal cannot reach executable or configuration paths; and if feasible, block or filter requests whose filename parameters contain ../ or absolute paths at the proxy. Trade-offs: reverse-proxy authentication and network restrictions break any client that legitimately reaches the runtime directly, and read-only filesystem hardening may interfere with caching or model-download workflows that expect writable paths.
Remote code execution in SGLang (versions up to and including 0.5.15) allows unauthenticated attackers to run arbitrary
SGLang's multimodal generation module deserializes untrusted data with pickle.loads() over an unauthenticated ZMQ broker
SGLang's encoder parallel disaggregation system is vulnerable to unauthenticated RCE through pickle deserialization in t
Unauthenticated remote code execution in SGLang (the LLM/multimodal generation serving runtime) affecting version 5.10 a
Remote code execution in SGLang 0.5.9's /v1/rerank endpoint allows unauthenticated attackers to execute arbitrary code b
Remote code execution in SGLang (versions up to and including 0.5.15) allows attackers to run arbitrary code on the infe
We need answer JSON only. Need synthesize. Need obey all rules. Let's parse input. CVE-2026-86793 description: SGLang a
Remote code execution in SGLang (versions ≤ v0.5.15) allows attackers to achieve arbitrary code execution through the op
Unauthenticated remote code execution affects SGLang, an LLM/multimodal inference-serving framework, at version 5.10, wh
Unauthenticated remote code execution in SGLang (versions 0 through 0.5.14) arises when the expert-parallel backup subsy
High severity vulnerability in SGLang. SGLangs `replay_request_dump.py` contains an insecure pickle.load() without valid
SGLang versions up to and including v0.5.15 expose unauthenticated network endpoints that allow complete model weight ex
Same weakness CWE-35 – Path Traversal: '.../...//'
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today