CVE-2026-116046
mediumA flaw has been found in eventcatalog sdk up to 2.29.0.
A flaw has been found in eventcatalog sdk up to 2.29.0. This vulnerability affects the function getCustomDoc/writeCustomDoc/rmCustomDoc of the file packages/sdk/src/custom-docs.ts of the component Custom Documentation Helpers. This manipulation of the argument options.path causes path traversal. It is possible to launch the attack on the local host. Upgrading to version 2.30.0 is able to resolve this issue. Patch name: a4f072a03f440d58230092e88d8b4893f4c6d6ca. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/event-catalog/eventcatalog/commit/a4f072a03f440d58230092e88d8b4893f4c6d... cna@vuldb.com
- https://github.com/event-catalog/eventcatalog/pull/2936 cna@vuldb.com
- https://github.com/event-catalog/eventcatalog/releases/tag/%40eventcatalog%2Fsdk%402.30.0 cna@vuldb.com
- https://vuldb.com/cve/CVE-2026-116046 cna@vuldb.com
- https://vuldb.com/submit/994176 cna@vuldb.com
- https://vuldb.com/vuln/426122 cna@vuldb.com
- https://vuldb.com/vuln/426122/cti cna@vuldb.com