CVE-2026-7302: Path Traversal
SGLangs multimodal generation runtime is vulnerable to an unauthenticated path traversal vulnerability, allowing an attacker to write arbitrary files anywhere the server process has write access, by including ../ sequences in the upload filename when sent to specific endpoints.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-7302?
CVE-2026-7302 is considered a high-severity vulnerability due to its potential to allow unauthorized file writes.
How do I fix CVE-2026-7302?
To fix CVE-2026-7302, you should implement input validation and restrict file path handling to prevent traversal attacks.
What are the risks associated with CVE-2026-7302?
The risks associated with CVE-2026-7302 include unauthorized access to the file system and the potential for remote code execution if malicious files are written.
Which software is affected by CVE-2026-7302?
CVE-2026-7302 affects the SGLangs multimodal generation runtime.
Can CVE-2026-7302 be exploited remotely?
Yes, CVE-2026-7302 can be exploited remotely by attackers who can send specially crafted requests to the affected server.