CVE-2026-105032

Deferred Deferred - Pending Action

Unauthenticated Path Traversal in Eilik and EilikO AI Skills

Publication date: 2026-10-15

Last updated on: 2026-10-16

Assigner: Austin Hackers Anonymous

Description

The EnergizeLab Eilik and EilikO AI skill upload endpoint, served by the FastAPI AI inference and profiling services, does not require authentication and does not constrain uploaded file paths. An unauthenticated remote attacker can use path traversal to write arbitrary files, and thereby tamper with AI skill files used by Eilik and EilikO robots.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-15

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-16

EPSS Evaluated

2026-10-18

NVD

CVE-2026-105032

Affected Vendors & Products

Vendor	Product	Version / Range
EnergizeLab	FastAPI	AI inference server n/a

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-434	The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability is in the EnergizeLab Eilik and EilikO AI skill upload endpoint, which is part of the FastAPI AI inference and profiling services. The endpoint lacks authentication and path constraints, allowing unauthenticated attackers to use path traversal to write arbitrary files. This could let them tamper with AI skill files used by Eilik and EilikO robots.

Detection Guidance

Check for unauthorized file uploads or unexpected file modifications in directories used by Eilik or EilikO robots. Inspect FastAPI AI inference server logs for path traversal attempts or unusual file writes.

Impact Analysis

An attacker could exploit this to overwrite critical AI skill files, potentially altering robot behavior, causing malfunctions, or executing unauthorized commands. This could lead to operational disruptions, data corruption, or unauthorized access to robot systems.

Compliance Impact

This vulnerability allows unauthenticated attackers to write arbitrary files via path traversal, which could lead to unauthorized modifications of AI skill files. This may violate compliance requirements for data integrity and access control in standards like GDPR and HIPAA, as it enables tampering with critical system files without authentication.

Mitigation Strategies

Immediately restrict access to the FastAPI AI inference server to authenticated users only. Apply path validation to uploaded files to prevent path traversal. Update to a patched version if available.

Hi! I’m here to help you understand CVE-2026-105032. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70