CVE-2026-105032: EnergizeLab Eilik AI Skill Upload Unauthenticated Path Traversal Arbitrary File Write
The EnergizeLab Eilik and EilikO AI skill upload endpoint, served by the FastAPI AI inference and profiling services, does not require authentication and does not constrain uploaded file paths. An unauthenticated remote attacker can use path traversal to write arbitrary files, and thereby tamper with AI skill files used by Eilik and EilikO robots.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
EnergizeLab Eilik and EilikO deployments are exposed where the FastAPI AI inference and profiling services expose the vulnerable AI skill upload endpoint to remote attackers.
What does an attacker need to exploit this issue?
The attacker needs network access to the upload endpoint. No authentication, privileges, or user interaction are required, and the attack uses path traversal in an uploaded file path.
What could an attacker change?
An attacker can write arbitrary files through the upload endpoint, including tampering with AI skill files used by Eilik and EilikO robots.
What can be done if a fix is not immediately available?
Restrict remote access to the FastAPI AI inference and profiling services and disable or block access to the AI skill upload endpoint where possible. This reduces exposure because exploitation requires network access to that endpoint.