Skip to content
CVE PROGRAM SOURCE RECORD4.8 Medium

CVE-2026-116046

eventcatalog sdk Custom Documentation Helpers custom-docs.ts rmCustomDoc path traversal

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulDB

Description

A flaw has been found in eventcatalog sdk up to 2.29.0. This vulnerability affects the function getCustomDoc/writeCustomDoc/rmCustomDoc of the file packages/sdk/src/custom-docs.ts of the component Custom Documentation Helpers. This manipulation of the argument options.path causes path traversal. It is possible to launch the attack on the local host. Upgrading to version 2.30.0 is able to resolve this issue. Patch name: a4f072a03f440d58230092e88d8b4893f4c6d6ca. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

eventcatalog sdk

  • 2.0affected
  • 2.1affected
  • 2.2affected
  • 2.3affected
  • 2.4affected
  • 2.5affected
  • 2.6affected
  • 2.7affected
  • 2.8affected
  • 2.9affected
  • 2.10affected
  • 2.11affected
  • 2.12affected
  • 2.13affected
  • 2.14affected
  • 2.15affected
  • 2.16affected
  • 2.17affected
  • 2.18affected
  • 2.19affected
  • 2.20affected
  • 2.21affected
  • 2.22affected
  • 2.23affected
  • 2.24affected
  • 2.25affected
  • 2.26affected
  • 2.27affected
  • 2.28affected
  • 2.29.0affected
  • 2.30.0unaffected

References