Ai Goofish Monitor
Monthly
Unauthenticated arbitrary file read in Usagi-org Ai Goofish Monitor on Windows deployments allows remote attackers to read arbitrary files by supplying absolute Windows paths or backslash-based traversal sequences to the /api/prompts/{filename} endpoint. The vulnerability, tracked as CVE-2026-10044, bypasses an incomplete path sanitisation guard that only blocks forward slashes and dot-dot sequences, enabling attackers to access sensitive files such as system configuration files. A publicly available proof-of-concept exists, but the EPSS score is low (0.05%) and there is no evidence of active exploitation at the time of analysis.
Unauthenticated arbitrary file read in Usagi-org Ai Goofish Monitor on Windows deployments allows remote attackers to read arbitrary files by supplying absolute Windows paths or backslash-based traversal sequences to the /api/prompts/{filename} endpoint. The vulnerability, tracked as CVE-2026-10044, bypasses an incomplete path sanitisation guard that only blocks forward slashes and dot-dot sequences, enabling attackers to access sensitive files such as system configuration files. A publicly available proof-of-concept exists, but the EPSS score is low (0.05%) and there is no evidence of active exploitation at the time of analysis.