ai-fusion-video EUVD-2026-99253

Requires a valid authenticated account (PR:L) able to reach POST /api/storage/upload, and the instance must use the local filesystem storage backend (LocalStorageStrategy) rather than a remote/object store, since the flaw is the missing normalization in LocalStorageStrategy.storeBytes. The attacker controls the subDir parameter and supplies parent-directory (../) sequences plus a chosen filename and extension. Exploitation is limited to directories the service account has write permission to, and impact scales with where that account can write (e.g., a web-served or configuration directory); it does not grant read/confidentiality access by itself. Limiting factors: authentication is mandatory, and no confidentiality or availability impact is produced by the write primitive alone.

This is a moderate, not top-tier, priority. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and the 5.3 base score agree with the description: network-reachable, low attack complexity, no user interaction, but requiring authentication (PR:L) and yielding only limited integrity impact (VI:L) with no confidentiality or availability impact. No EPSS score, CISA KEV listing, or explicit POC/exploit-code flag is present in the input, so there is no signal of active or widespread exploitation - the exploitation status is 'no public exploit identified at time of analysis.' Two of the four NVD references are human-written analyses (a hackmd write-up and a VulnCheck advisory) that describe the flaw in detail, which lowers the barrier to weaponization even though no packaged exploit is indicated. One tension worth flagging: the vendor rates integrity as Low (VI:L), but the description states an attacker can write attacker-controlled files with chosen extensions anywhere the service account can write - depending on deployment that could enable webshell drop or config overwrite and a higher real integrity impact, so the Low rating may understate worst-case risk. Overall, the authentication requirement and the niche nature of the affected product keep real-world risk contained, making this a 'patch in normal cycle' item rather than an emergency.

An authenticated low-privilege user of an ai-fusion-video instance sends a POST to /api/storage/upload with a subDir value containing ../ sequences, causing LocalStorageStrategy.storeBytes to write the uploaded file outside the intended media directory. By choosing the filename, extension, and traversal target, the attacker plants attacker-controlled content (e.g., into a web-served or config directory) anywhere the service account can write. No packaged public exploit is indicated, but detailed technical write-ups of the flaw are publicly referenced.