CVE-2026-116046: eventcatalog sdk Custom Documentation Helpers custom-docs.ts rmCustomDoc path traversal
A flaw has been found in eventcatalog sdk up to 2.29.0. This vulnerability affects the function getCustomDoc/writeCustomDoc/rmCustomDoc of the file packages/sdk/src/custom-docs.ts of the component Custom Documentation Helpers. This manipulation of the argument options.path causes path traversal. It is possible to launch the attack on the local host. Upgrading to version 2.30.0 is able to resolve this issue. Patch name: a4f072a03f440d58230092e88d8b4893f4c6d6ca. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
eventcatalog sdkto a version that resolves this vulnerability.Fixed in 2.30.0Patch a4f072a03f440d58230092e88d8b4893f4c6d6ca
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using npm/@eventcatalog/sdk version 2.29.0 or earlier are affected. The vulnerable functionality is in the Custom Documentation Helpers implementation in packages/sdk/src/custom-docs.ts.
What access does an attacker need to exploit it?
The attack is performed on the local host and requires low privileges. Exploitation involves controlling the options.path argument passed to getCustomDoc, writeCustomDoc, or rmCustomDoc.
What is the recommended remediation?
Upgrade npm/@eventcatalog/sdk to version 2.30.0. The available fix is identified by patch a4f072a03f440d58230092e88d8b4893f4c6d6ca.