Which versions of Iopaint are affected by EUVD-2026-17821?

IOPaint version 1.5.3 contains a critical path traversal vulnerability in its file manager that allows unauthenticated attackers to read, write, or delete arbitrary files on affected systems over the…

Is there a public PoC exploit available for EUVD-2026-17821?

Yes, a public proof-of-concept exploit is available for EUVD-2026-17821. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate EUVD-2026-17821?

Within 24 hours: Identify all IOPaint instances running version 1.5.3 in your environment and isolate them from untrusted networks. Within 7 days: Contact Sanster for patch availability status and interim guidance; evaluate alternative file management solutions or temporary network segmentation. Within 30 days: Either deploy a patched version of IOPaint when available, migrate to a supported alternative with equivalent functionality, or implement compensating network controls (WAF rules, IP allowlisting) if operational continuity requires IOPaint 1.5.3 to remain in use.

Iopaint EUVD-2026-17821

Q: What is the CVSS score of EUVD-2026-17821?

EUVD-2026-17821 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2026-5258 MEDIUM

Path Traversal (CWE-22)

2026-04-01 VulDB

GHSA-qw2j-qjh4-32jw

Path Traversal Iopaint

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

PoC Detected

Apr 01, 2026 - 14:23 vuln.today

Public exploit code

EUVD ID Assigned

Apr 01, 2026 - 07:00 euvd

EUVD-2026-17821

Analysis Generated

Apr 01, 2026 - 07:00 vuln.today

CVE Published

Apr 01, 2026 - 06:45 nvd

MEDIUM 6.9

DescriptionCVE.org

A vulnerability was found in Sanster IOPaint 1.5.3. Impacted is the function _get_file of the file iopaint/file_manager/file_manager.py of the component File Manager. Performing a manipulation of the argument filename results in path traversal. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Path traversal in Sanster IOPaint 1.5.3 File Manager allows unauthenticated remote attackers to read, write, or delete arbitrary files via manipulated filename parameters in the _get_file function. EPSS data unavailable, but publicly available exploit code exists. Attack requires no authentication or user interaction (CVSS AV:N/PR:N/UI:N). Vendor did not respond to coordinated disclosure; patch status unknown at time of analysis.

Technical ContextAI

This vulnerability affects the IOPaint file manager component, specifically the _get_file function in iopaint/file_manager/file_manager.py. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), commonly known as path traversal. The affected product is Sanster IOPaint version 1.5.3 (CPE: cpe:2.3:a:sanster:iopaint:*:*:*:*:*:*:*:*), an AI-powered image inpainting tool. The vulnerability occurs when the application fails to properly sanitize user-supplied filename arguments before using them in file system operations, allowing attackers to escape intended directory boundaries using sequences like '../' to access files outside the designated file manager scope. This class of vulnerability typically enables reading sensitive configuration files, overwriting critical system files, or deleting data depending on application privileges and the specific file operations exposed.

RemediationAI

No vendor-released patch identified at time of analysis due to vendor non-responsiveness to coordinated disclosure. Primary mitigation: immediately upgrade to a version newer than 1.5.3 if available, or discontinue use of IOPaint 1.5.3 in production environments until a confirmed fix is released. Monitor the official Sanster IOPaint GitHub repository for security updates. Interim workarounds include implementing strict input validation and sanitization for all filename parameters at the web application firewall or reverse proxy layer, restricting filesystem permissions for the IOPaint process to the minimum required scope, and deploying IOPaint within containerized environments with read-only filesystem mounts where feasible. Network-level controls such as restricting access to trusted IP ranges can reduce attack surface but do not eliminate the vulnerability. Review VulDB references at https://vuldb.com/vuln/354448 and the public exploit disclosure at https://github.com/August829/CVEP/issues/11 for technical details to inform detection and response strategies.