CVE-2026-116073

🎯 CVE-2026-116073 🧪 PoC 🇪🇺 EUVD

💬 0 Diskussion 📄 .md Alle CVEs anzeigen ✕

CVE-2026-116073 | Leon before commit 50df142 contains a path traversal vulnerability in getModelFileNameFromURL() that allows attackers to write files outside the models directory via percent-encoded separators. Attackers can trick a user into running '/download model' with a crafted URL containing encoded '../' sequences to write attacker-controlled content to arbitrary paths writable by Leon.

Leon before commit 50df142 contains a path traversal vulnerability in getModelFileNameFromURL() that allows attackers to write files outside the models directory via percent-encoded separators. Attackers can trick a user into running '/download model' with a crafted URL containing encoded '../' sequences to write attacker-controlled content to arbitrary paths writable by Leon.

Klassifikation & Betroffenheit:

CWE-22 leon-ai leon a3afdef81c8dd085b922f5a4e6b68bb9b9d802e4 <50df142a89a0859e5b7283d87afdab7b01e712a2

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') 🎯 High

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

🛡️ Empfohlene Mitigation: Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all …

Vollständige Definition bei MITRE ➔

⚔️ Typische Angriffsmuster (CAPEC):

CAPEC-64 · Using Slashes and URL Encoding Combined … (High) CAPEC-76 · Manipulating Web Input to File System Ca… (Very High) CAPEC-78 · Using Escaped Slashes in Alternate Encod… (High) CAPEC-79 · Using Slashes in Alternate Encoding (High) CAPEC-126 · Path Traversal (Very High)

🧩 Ähnliche Schwachstellen (Hersteller/Klasse/Score-Band):

CVE-2026-104025 8.4 CVE-2024-46954 8.4 CVE-2024-29434 8.3 CVE-2024-21677 8.3 CVE-2024-47049 8.2

🩹 Patch verfügbar (OSV):

🩹 50df142a89a0859e5b7283d87afdab7b01e712a2 (Commit)

📰 Eigene Berichterstattung: ➔ CVE-2026-116073 | leon-ai Leon URL getModelFileNameFromURL path traversal (EUVD-

📚 Referenzen & Quellen:

🇪🇺 Original-Eintrag (ENISA EUVD) 🇺🇸 NVD-Eintrag

Ausnutzungs-Zeitleiste:

Reserviert 2026

Veröffentlicht 10/2026

Heute 30.10.

CVSS-Vektor-Analyse: 6.9

AV · Angriffsvektor Netzwerk

AC · Komplexität Gering

PR · Privilegien Keine

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

CNA-Bewertung (VulnCheck): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA…

Veröffentlicht:25.10.2026

Aktualisiert:25.10.2026 11:51

Assigner (CNA):VulnCheck

EUVD-ID:EUVD-2026-109387

CWE-22 ✓ Offizieller Patch / Advisory verfügbar

💡 Gegenmaßnahme: Sicherheits-Update des Herstellers zeitnah einspielen und Netzwerksegmentierung prüfen.

Tier	CVEs	Anteil
≥90 %	743	0,2 %
≥50 %	3.224	0,8 %
≥10 %	22.074	5,8 %
<10 %	354.688	93,2 %

6.9 MEDIUM

EPSS

0.3%

CVE-2026-116073 🌐 Netzwerk (Remote) 🔓 Keine Authentifizierung nötig

leon-ai

CVE-2026-116073 | Leon before commit 50df142 contains a path traversal vulnerability in getModelFileNameFromURL() that allows attackers to write files outside the models directory via percent-encoded separators. Attackers can trick a user into running '/download model' with a crafted URL containing encoded '../' sequences to write attacker-controlled content to arbitrary paths writable by Leon.

CWE-22 ✓ Offizieller Patch / Advisory verfügbar

💡 Gegenmaßnahme: Sicherheits-Update des Herstellers zeitnah einspielen und Netzwerksegmentierung prüfen.

vor 5 Tagen

🛡️ Details ➔

Zero-Day & Vulnerability Intelligence Hub