EUVD-2026-91125
GHSA-45p5-w2r8-mrfv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach live tutorbot WebSocket endpoint
-
DeliverySend EditFileTool request with absolute/traversal path
-
ExploitWrite or edit file outside bot workspace
-
ExecutionOverwrite sensitive config or code
-
ImpactAchieve code execution on host
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the DeepTutor 1.4.0 'live tutorbot' WebSocket interface is running and network-reachable by the attacker; the EditFileTool must be invocable through that tool layer (its default behavior in this version). Per CVSS PR:N/UI:N, no authentication or user interaction is needed on that interface, so any client able to open the WebSocket can drive the write. The primary LIMITING factor is deployment exposure: instances that do not run the live tutorbot server, or that restrict the WebSocket to localhost/trusted networks, are not remotely exploitable. No KEV-confirmed active exploitation, so risk is concentrated on internet-exposed instances. |
| Impact | Signals conflict sharply and must be weighed together. CVSS 3.1 rates this 9.8 Critical (AV:N/AC:L/PR:N/UI:N, all impacts High) and SSVC marks it Automatable=yes with Total technical impact, which argues for high priority. However, EPSS is only 0.14% (3rd percentile), indicating very low modeled probability of widespread exploitation, and the vulnerability is NOT in CISA KEV - so there is no evidence of active exploitation in the wild. A public exploit does appear to exist (SSVC Exploitation=poc, plus a referenced gist), so weaponization is trivial for anyone who targets an exposed instance. The dominant mitigating factor is reach: DeepTutor is a niche open-source AI tutoring project, not enterprise-ubiquitous software, so the realistic attack surface is limited to the small number of operators who actually run the live tutorbot WebSocket interface and expose it to untrusted networks. Net: a genuine high-severity flaw for anyone running the affected component, but the low EPSS and niche footprint make this targeted/opportunistic rather than a mass-exploitation emergency. Note also that NVD metadata is weak - CPE and EUVD list 'n/a' placeholders and the vendor (HKUDS) is unlabeled - so affected-version enumeration should be verified against the GitHub issue rather than NVD. |
| Exploit ScenarioDerived | An attacker reaches an exposed DeepTutor 1.4.0 live tutorbot WebSocket endpoint without authenticating and sends a crafted EditFileTool request specifying an absolute or traversal path outside the bot workspace. Because the tool layer honors the attacker-controlled path, the attacker writes or overwrites arbitrary files on the host - e.g., a startup script, SSH key, or application code - which can escalate to remote code execution. Publicly available exploit code exists (referenced gist), lowering the skill barrier. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 05, 2026
Unauthenticated remote clients can escape the intended bot workspace and write or overwrite arbitrary absolute filesystem paths through DeepTutor 1.4.0's live 'tutorbot' WebSocket interface, because the EditFileTool.execute path-traversal flaw (CWE-22) fails to contain caller-supplied paths to the workspace root; with CVSS 3.1 AV:N/AC:L/PR:N/UI:N and total confidentiality/integrity/availability impact, this rates 9.8 and can corrupt configuration, application code, or authentication material. Publicly available exploit code exists (SSVC Exploitation: poc, Automatable: yes) and the issue is tracked upstream as HKUDS/DeepTutor issue 517 with a public proof-of-concept gist, but there is no KEV-confirmed active exploitation and EPSS is low at 0.14% (3rd percentile), so the practical risk is concentrated on instances whose tutorbot WebSocket is internet-reachable rather than restricted to localhost or a trusted network.
RemediationAI
No vendor-released patch has been identified at the time of analysis: no fixed version is specified in the advisory data, and the references point to upstream issue https://github.com/HKUDS/DeepTutor/issues/517 and a public PoC gist (https://gist.github.com/Ro1ME/b5ea6ac856a593e1d20042eb72c00fae) rather than to a tagged release, so treat any upstream commit as an unverified fix until the maintainer publishes a version. Until then, the highest-value control is exposure reduction: bind the live tutorbot WebSocket to 127.0.0.1 and reach it only through an authenticated reverse proxy or SSH tunnel, or block the port at the perimeter - the trade-off is that remote/legitimate tutorbot clients lose direct access and must be re-routed. Add an authentication and origin-check layer in front of the WebSocket and reject non-loopback peers, accepting the added operational complexity and latency. Run DeepTutor under a dedicated low-privilege account inside a container with the application directory and any secrets volume mounted read-only and with a writable scratch directory that is the only bind-mounted path, which converts an arbitrary-write into a contained write but can break features that legitimately edit project files. Apply filesystem hardening such as AppArmor/SELinux or systemd ProtectSystem=strict, ReadWritePaths limited to the workspace, and no write access to /etc, /root, ~/.ssh, or the Python site-packages directory, so that even a successful traversal cannot persist code or keys; verify no symbolic links from the workspace to sensitive locations exist. Finally, monitor DeepTutor release notes and the GitHub issue for an official patched version, and in the interim watch for anomalous file modifications outside the workspace by the service account as a detection signal.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
DeepTutor is an agent-style tutoring framework in which an LLM tool layer exposes filesystem operations such as EditFileTool.execute to a conversational backend; the flaw is a classic CWE-22 improper limitation of a pathname to a restricted directory, i.e., the tool resolves attacker-influenced path strings without canonicalizing them and verifying that the result remains beneath the configured bot workspace, so absolute paths (and traversal sequences) are honored verbatim. The delivery channel is the live tutorbot WebSocket interface, which accepts tool-invocation messages and, per the assessed CVSS vector (PR:N, UI:N), requires neither authentication nor user interaction to drive the write - meaning any network client that can open the socket can reach the file-write primitive. The CPE string supplied is effectively unpopulated (n/a:n/a), and EUVD likewise lists no concrete version data, so product identification rests on the vendor repository HKUDS/DeepTutor and the issue reference; the SSVC decision point 'Technical Impact: total' reflects that an arbitrary-write primitive with root-adjacent or service-level file access can subvert the host rather than merely read data. Note that the 9.8 base score describes worst-case impact on a reachable interface, not the probability that any given deployment is exposed.
Know when Deeptutor gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated remote caller abuses the WebSocket EditFileTool to read/write/overwrite arbitrary host files, so AV:N/AC:L/PR:N/UI:N with High confidentiality, integrity, and availability via potential code overwrite.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
deeptutor 1.4.0 contains a path traversal issue in EditFileTool.execute. Through the live tutorbot WebSocket interface, a remote caller can induce the tool layer to write or edit absolute paths outside the intended bot workspace.
Executive ViewAI
DeepTutor 1.4.0, an AI tutoring platform exposing a live 'tutorbot' WebSocket interface, lets any unauthenticated remote client write to or overwrite arbitrary files anywhere on the host filesystem, which exposes configuration data, application code, and authentication material to tampering or destruction. Any organization running an internet-reachable DeepTutor instance should treat this as a high-priority exposure, because a single unauthenticated request can undermine the integrity and availability of the platform and anything else on that host. Leadership should care less about the low exploit-prediction score and more about the fact that no vendor fix currently exists while a public proof-of-concept is already circulating.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict the tutorbot WebSocket to localhost or a trusted network and block external reachability at the edge; enforce authenticated reverse-proxy access in front of the service; run DeepTutor under a dedicated low-privilege account inside a container or chroot with a read-only filesystem view outside the bot workspace; monitor file integrity on configuration, code, and authentication paths for unauthorized modifications.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Remote unauthenticated code execution in DeepTutor 1.4.0 lets any network caller who can reach the live tutorbot WebSock
Privilege escalation via missing authorization in HKUDS DeepTutor before 1.4.10 lets any authenticated low-privilege use
Exploit-DB