CVE-2026-114379: EKKOLearnAI ekko-studio Media Generation API media.ts saveGeneratedImages file inclusion
A flaw has been found in EKKOLearnAI ekko-studio up to 1.0.6. This vulnerability affects the function saveGeneratedImages of the file packages/server/src/modules/studio/controllers/media.ts of the component Media Generation API. This manipulation of the argument outputpath causes file inclusion. Remote exploitation of the attack is possible. Patch name: 1d42459c292f89e412f7f6243829e7fed2e85bf5. It is recommended to apply a patch to fix this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
EKKOLearnAI ekko-studioto a version that resolves this vulnerability.Patch 1d42459c292f89e412f7f6243829e7fed2e85bf5
Event History
Frequently Asked Questions
What level of access does an attacker need?
An attacker needs low-level privileges to exploit the issue. Exploitation can be performed remotely and does not require user interaction.
Which installations should be treated as affected?
EKKOLearnAI ekko-studio versions up to and including 1.0.6 are identified as affected. The vulnerable code is in the Media Generation API's saveGeneratedImages function.
What is the expected security impact?
The supplied severity vector indicates no confidentiality impact, with low integrity and availability impact. The issue allows manipulation of the output_path argument, resulting in file inclusion.
What should be done to remediate the issue?
Apply patch 1d42459c292f89e412f7f6243829e7fed2e85bf5. No alternative mitigation is documented in the provided information.