CVE-2026-81560

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-81560
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-81560.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-81560
Published
2026-08-27T10:30:11.125Z
Modified
2026-08-30T03:30:39.222690727Z
Severity
  • 5.5 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
blackms aistack Static File server.ts path traversal
Details

A vulnerability was identified in blackms aistack up to 1.6.1. Affected by this issue is some unknown functionality of the file src/web/server.ts of the component Static File Handler. Such manipulation of the argument req.url leads to path traversal. The attack can be executed remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81560.json",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "1.6.0"
                },
                {
                    "last_affected": "1.6.0"
                }
            ]
        }
    ],
    "cwe_ids": [
        "CWE-22"
    ],
    "cna_assigner": "VulDB"
}
References

Affected packages

Git / github.com/blackms/aistack

Affected ranges

Type
GIT
Repo
https://github.com/blackms/aistack
Events
Introduced
f5f7d737879dc24a77dcc06ccd5f69918535cdf8
Last affected
f5f7d737879dc24a77dcc06ccd5f69918535cdf8
Database specific
Show details 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "1.6.1"
        },
        {
            "last_affected": "1.6.1"
        }
    ]
}

Affected versions

1.*
1.6.1
v1.*
v1.6.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-81560.json"