CVE-2026-101080
mediumA vulnerability was identified in Tencent AI-Infra-Guard up to 4.5.2/4.6.2.
A vulnerability was identified in Tencent AI-Infra-Guard up to 4.5.2/4.6.2. This affects the function startsWith of the file skill_scan/tools/dir/dir_actions.py of the component File Access. The manipulation leads to path traversal. The attack needs to be performed locally. The exploit is publicly available and might be used. Upgrading to version 4.6.0 is able to mitigate this issue. The identifier of the patch is ac0384edc9dbea3b226edefcf50613bd8509134f. You should upgrade the affected component.
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/Tencent/AI-Infra-Guard/ cna@vuldb.com
- https://github.com/Tencent/AI-Infra-Guard/commit/ac0384edc9dbea3b226edefcf50613bd8509134f cna@vuldb.com
- https://github.com/Tencent/AI-Infra-Guard/issues/538 cna@vuldb.com
- https://github.com/Tencent/AI-Infra-Guard/pull/539 cna@vuldb.com
- https://github.com/Tencent/AI-Infra-Guard/releases/tag/v4.6.0 cna@vuldb.com
- https://vuldb.com/cve/CVE-2026-101080 cna@vuldb.com
- https://vuldb.com/submit/931298 cna@vuldb.com
- https://vuldb.com/vuln/410952 cna@vuldb.com
- https://vuldb.com/vuln/410952/cti cna@vuldb.com