CVE-2026-110212: ai-fusion-video through 1.2.0 Path Traversal in Media Upload subDir Parameter
Stonewuu ai-fusion-video through 1.2.0 contains a path traversal vulnerability that allows authenticated users to write uploaded files outside the media directory via the subDir parameter of POST /api/storage/upload. Attackers can supply parent-directory sequences that LocalStorageStrategy.storeBytes never normalizes, creating directories and writing attacker-controlled files with chosen extensions anywhere the service account can write.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated and able to send requests to POST /api/storage/upload. The impact is limited to locations writable by the account running the ai-fusion-video service.
What does an attacker need to provide to write outside the media directory?
The attacker can place parent-directory sequences in the subDir parameter. Because LocalStorageStrategy.storeBytes does not normalize this value, the upload can create directories and write attacker-controlled files with chosen extensions outside the intended media directory.
How can I determine whether my deployment is affected?
Deployments of Stonewuu ai-fusion-video through version 1.2.0 are affected if authenticated users can access the upload endpoint and the service account has writable paths beyond the media directory. Review upload requests and filesystem activity for subDir values containing parent-directory sequences and for unexpected files or directories created by the service account.
What can be done if patching is not immediately possible?
Restrict access to POST /api/storage/upload to only trusted authenticated users, and run the service under an account with write permissions limited to the intended media directory. Monitor for unexpected filesystem writes and uploaded files outside that directory.