CVE-2026-85688: TEN Framework 0.11.71 Unauthenticated File Read/Write via TMAN Designer
TEN Framework 0.11.71 contains unauthenticated arbitrary file read and write vulnerabilities in the TMAN Designer file-content API endpoints. Attackers can submit POST and PUT requests to the /api/designer/v1/file-content endpoints to read arbitrary files or write malicious content to system paths, enabling code execution through authorizedkeys, cron files, or executable graph files.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
No authentication or user interaction is required. An attacker able to send POST or PUT requests to the TMAN Designer /api/designer/v1/file-content endpoints can attempt arbitrary file reads or writes.
Which deployments are exposed?
Deployments of TEN Framework 0.11.71 where the TMAN Designer file-content API endpoints are reachable by an attacker are exposed. The provided information does not state whether these endpoints are enabled or network-accessible by default.
What is the likely impact of a successful write?
An attacker may write malicious content to system paths. The reported examples include authorized_keys, cron files, and executable graph files, which can enable code execution.
What can be done while a fix is not available?
Restrict access to the TMAN Designer /api/designer/v1/file-content endpoints so untrusted attackers cannot send POST or PUT requests. Review exposure of these endpoints and limit network reachability to trusted administrative users or systems.
How can defenders investigate possible exploitation?
Review requests to /api/designer/v1/file-content, particularly POST and PUT requests, for unexpected file paths or content. Inspect sensitive locations such as authorized_keys, cron files, and executable graph files for unauthorized changes.