Ekko Studio
Monthly
EKKOLearnAI ekko-studio through 1.0.6 lets an authenticated low-privilege user supply an attacker-controlled output_path to the Media Generation API, which the saveGeneratedImages handler in packages/server/src/modules/studio/controllers/media.ts passes into a file operation without adequate path validation. Successful abuse gives limited file integrity and availability impact (CVSS:3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) with no confidentiality disclosure per the authoritative assessment, and requires a valid account plus network reachability to the media-generation endpoint - anonymous attackers cannot trigger it. No public exploit code was identified at time of analysis, exploitation has not been confirmed in the wild, and an upstream fix exists as commit 1d42459c292f89e412f7f6243829e7fed2e85bf5 (PR #3404) that removes the ordinary-user ability to request custom image/video output paths.
Missing authorization in Ekko Studio through 0.7.36 allows any authenticated user who is not a super_admin to list and clear server-wide login lockouts through the /api/auth/locked-ips endpoint, with a DELETE request lacking an ip parameter invoking the unlockAll() routine. The practical consequence is that the application's login rate limiter can be reset at will, removing the primary obstacle to sustained password guessing against super_admin accounts; the flaw requires a valid low-privileged account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, medium severity), so it is most relevant to insider or post-compromise scenarios rather than fully unauthenticated external attack, and it yields no direct account takeover on its own. No public exploit identified at time of analysis (no CISA KEV listing and no exploit code referenced); vendor-supplied fix data is present.
EKKOLearnAI ekko-studio through 1.0.6 lets an authenticated low-privilege user supply an attacker-controlled output_path to the Media Generation API, which the saveGeneratedImages handler in packages/server/src/modules/studio/controllers/media.ts passes into a file operation without adequate path validation. Successful abuse gives limited file integrity and availability impact (CVSS:3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) with no confidentiality disclosure per the authoritative assessment, and requires a valid account plus network reachability to the media-generation endpoint - anonymous attackers cannot trigger it. No public exploit code was identified at time of analysis, exploitation has not been confirmed in the wild, and an upstream fix exists as commit 1d42459c292f89e412f7f6243829e7fed2e85bf5 (PR #3404) that removes the ordinary-user ability to request custom image/video output paths.
Missing authorization in Ekko Studio through 0.7.36 allows any authenticated user who is not a super_admin to list and clear server-wide login lockouts through the /api/auth/locked-ips endpoint, with a DELETE request lacking an ip parameter invoking the unlockAll() routine. The practical consequence is that the application's login rate limiter can be reset at will, removing the primary obstacle to sustained password guessing against super_admin accounts; the flaw requires a valid low-privileged account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, medium severity), so it is most relevant to insider or post-compromise scenarios rather than fully unauthenticated external attack, and it yields no direct account takeover on its own. No public exploit identified at time of analysis (no CISA KEV listing and no exploit code referenced); vendor-supplied fix data is present.