EUVD-2026-90421
GHSA-vx7w-p635-5ppx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach bisheng file download/save API
-
ExploitInject ../ traversal in filename path
-
ExecutionWrite or read file outside cache directory
-
ImpactOverwrite sensitive files or exfiltrate data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires reaching the bisheng API path that invokes save_download_file (src/backend/bisheng/core/cache/utils.py:290) with an attacker-influenced filename or path component, then supplying directory-traversal sequences ('../') to escape the intended download/cache directory. It is limited to the specific affected releases 2.3.0, 2.4.0, and 2.4.0-beta1. The key limiting factor NOT resolved by available data is whether that endpoint is reachable without authentication: the CVSS vector claims PR:N, but if bisheng's file-handling route sits behind application login, valid credentials would be a prerequisite - defenders should confirm the endpoint's auth requirement against their deployment before assuming unauthenticated reachability. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity flaw requiring no privileges or user interaction, yielding a 9.1 CRITICAL score driven by high confidentiality and integrity impact (C:H/I:H) with no availability impact. However, the real-world signals temper this: EPSS is only 0.33% (24th percentile), the CVE is NOT on the CISA KEV list (no confirmed active exploitation), and the affected product - dataelement's open-source 'bisheng' LLM application platform - has a limited deployment footprint. These signals conflict with the raw score: a 9.1 on a niche, self-hosted developer platform is a far lower operational priority than the same score on ubiquitous infrastructure. One important caveat: the PR:N (unauthenticated) rating should be verified, because bisheng's file-handling endpoints frequently sit behind application login, and the description does not confirm the triggering endpoint is reachable pre-authentication - if authentication is in fact required, true risk drops further. Bottom line: a genuine, patch-worthy path-traversal bug for anyone running bisheng, but not a widespread-emergency 'CVSS 9.1' threat given low EPSS, no KEV, and narrow prevalence. |
| Exploit ScenarioDerived | An attacker sends a crafted request to the bisheng endpoint that invokes save_download_file (src/backend/bisheng/core/cache/utils.py:290), embedding '../' traversal sequences in the controlled filename/path so the saved file lands outside the intended cache directory. Depending on how the sink is used, this enables writing attacker-controlled files to arbitrary locations (potentially overwriting configuration or code) or reading/exfiltrating files outside the cache root. A referenced public gist appears to document the issue and may contain proof-of-concept detail, though explicit POC confirmation is not present in the structured input. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 01, 2026
Directory traversal in Bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 lets a remote attacker use crafted filename/path input to break out of the intended download/cache directory through the save_download_file routine (src/backend/bisheng/core/cache/utils.py:290), yielding arbitrary file read and write with a CVSS 3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). The vector indicates an unauthenticated, network-reachable attack with no user interaction, though the practical limiting factor is whether the API route that reaches save_download_file is exposed without a login - defenders should verify that against their own deployment before assuming unauthenticated reachability. Exploitation status: no public exploit identified at time of analysis, and there is no CISA KEV entry; EPSS is 0.33% (24th percentile), so mass exploitation is not currently expected, but the impact per successful attack is severe given the high confidentiality and integrity ratings and the absence of any availability impact.
RemediationAI
No vendor-released patch is identified in the available data for this issue, so the first action is to confirm the current state of upstream Bisheng - review the GitHub issue at https://github.com/dataelement/bisheng/issues/1994 and the project's release notes and commit history for a fix, and apply the patched release as soon as one is published rather than relying on any version currently in the 2.3.0/2.4.0/2.4.0-beta1 range. Until then, apply compensating controls in order of effectiveness: place the Bisheng API behind authentication and restrict network reachability of the file-handling endpoints to trusted clients only (network segmentation or a reverse-proxy allowlist), accepting that this may break legitimate external integrations; deploy Bisheng inside a container or VM whose filesystem is mounted read-only where possible and whose writable paths are confined to a dedicated cache volume, with the service account holding no privileges over application source, configuration, secrets, or the host's SSH and cron directories, which limits arbitrary-write impact to files the attacker can overwrite; and add an application-level or WAF rule that rejects request parameters containing path-traversal sequences ('../', encoded variants, and null bytes) for the download/cache endpoints, understanding that such filtering is a stopgap that can be bypassed by obfuscation and does not fix the underlying flaw. Because the assessed vector includes high confidentiality and integrity impact, also treat any suspected exploitation as a host-compromise event and review cached/download directories for unexpected files, as well as monitoring for anomalous process execution by the Bisheng service account.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, i.e. path traversal) in the Python helper save_download_file located at src/backend/bisheng/core/cache/utils.py line 290 of the Bisheng LLM application-development platform. Bisheng is an open-source platform that handles user-supplied documents, knowledge-base uploads and model artifacts, and this helper is responsible for persisting downloaded or cached files; because it processes an attacker-influenced filename or path component without adequately canonicalizing and constraining the resulting path, sequences such as '../' can resolve outside the intended download/cache directory. That gives an attacker both read and write primitives on the host filesystem under the privileges of the Bisheng service account, which is why the assessed vector assigns C:H/I:H while availability remains unaffected (A:N). The CPE data supplied with this record is a placeholder (cpe:2.3:a:n/a:n/a:*:*:*:*:*:*:*:*) and therefore provides no additional product or version granularity beyond the three affected release strings; the EUVD record EUVD-2026-90421 mirrors the same version set. The vulnerability is confined to the specific releases 2.3.0, 2.4.0, and 2.4.0-beta1, and the CVSS 3.1 vector describes low attack complexity and no required privileges or user interaction.
Know when N A gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Network-reachable traversal in a file save/download sink gives arbitrary file read and write (C:H/I:H), no availability impact; PR:N retained per source but endpoint auth is unverified.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to directory traversal in save_download_file (src/backend/bisheng/core/cache/utils.py:290).
Executive ViewAI
Bisheng versions 2.3.0, 2.4.0, and 2.4.0-beta1 contain a critical directory traversal vulnerability that can allow unauthenticated attackers to read or write arbitrary files on the server, potentially leading to data breaches or system compromise. No public exploit has been identified at time of analysis, and no vendor patch is available, so organizations using these versions should act immediately to mitigate risk. Leadership should care because successful exploitation could expose sensitive data or allow unauthorized modifications, impacting customer trust and regulatory compliance.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict network access to the Bisheng instance, enforce authentication on the API route reaching save_download_file, implement strict filename/path validation with allowlists, deploy a WAF to block directory traversal patterns, and monitor file system for unauthorized reads/writes.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Exploit-DB