CVE-2026-114379

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-114379

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-114379.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-114379

Published

2026-10-21T20:45:17Z

Modified

2026-10-22T10:46:15Z

Severity

5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X CVSS Calculator

Summary

EKKOLearnAI ekko-studio Media Generation API media.ts saveGeneratedImages file inclusion

Details

A flaw has been found in EKKOLearnAI ekko-studio up to 1.0.6. This vulnerability affects the function saveGeneratedImages of the file packages/server/src/modules/studio/controllers/media.ts of the component Media Generation API. This manipulation of the argument output_path causes file inclusion. Remote exploitation of the attack is possible. Patch name: 1d42459c292f89e412f7f6243829e7fed2e85bf5. It is recommended to apply a patch to fix this issue.

Database specific

{
    "cna_assigner":  "VulDB",
    "cwe_ids":  [
        "CWE-73"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/114xxx/CVE-2026-114379.json"
}

References

Affected packages

Git / github.com/ekkolearnai/ekko-studio

Affected ranges

Type

GIT

Repo

https://github.com/ekkolearnai/ekko-studio

Events

Introduced

4120d13cceb182ca60b8bcfcaef35917fbf36e26

Last Affected

ef9409601855557633edf07c08512b9dadb7a03f

Fixed

1d42459c292f89e412f7f6243829e7fed2e85bf5

Database specific

Show details

{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "1.0.0"
                },
                {
                    "last_affected":  "1.0.0"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "1.0.1"
                },
                {
                    "last_affected":  "1.0.1"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "1.0.2"
                },
                {
                    "last_affected":  "1.0.2"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "1.0.3"
                },
                {
                    "last_affected":  "1.0.3"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "1.0.4"
                },
                {
                    "last_affected":  "1.0.4"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "1.0.5"
                },
                {
                    "last_affected":  "1.0.5"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "1.0.6"
                },
                {
                    "last_affected":  "1.0.6"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "fixed":  "1d42459c292f89e412f7f6243829e7fed2e85bf5"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

1.*

1.0.0

1.0.1

1.0.2

1.0.3

1.0.4

1.0.5

1.0.6

hermes-0.*

hermes-0.20.4-runtime

hermes-0.20.6-runtime

hermes-0.21.0-runtime

hermes-0.21.3-runtime

hermes-0.21.5-runtime

v0.*

v0.6.43

v0.6.44

v0.6.45

v0.6.46

v0.6.47

v0.7.0

v0.7.1

v0.7.11

v0.7.12

v0.7.13

v0.7.14

v0.7.15

v0.7.16

v0.7.17

v0.7.18

v0.7.19

v0.7.20

v0.7.21

v0.7.22

v0.7.23

v0.7.24

v0.7.25

v0.7.26

v0.7.27

v1.*

v1.0.0

v1.0.1

v1.0.2

v1.0.3

v1.0.4

v1.0.5

v1.0.6

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-114379.json"