CVE-2026-110212

Awaiting Analysis Awaiting Analysis - Queue

Stonewuu AI Fusion Video Path Traversal Vulnerability

Publication date: 2026-10-13

Last updated on: 2026-10-14

Assigner: VulnCheck

Description

Stonewuu ai-fusion-video through 1.2.0 contains a path traversal vulnerability that allows authenticated users to write uploaded files outside the media directory via the subDir parameter of POST /api/storage/upload. Attackers can supply parent-directory sequences that LocalStorageStrategy.storeBytes never normalizes, creating directories and writing attacker-controlled files with chosen extensions anywhere the service account can write.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110212

EUVD

EUVD-2026-99253

Affected Vendors & Products

Vendor	Product	Version / Range
Stonewuu	ai-fusion-video	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability is a path traversal issue in Stonewuu ai-fusion-video through version 1.2.0. It allows authenticated users to write uploaded files outside the intended media directory by exploiting the subDir parameter in the POST /api/storage/upload endpoint. The LocalStorageStrategy.storeBytes function fails to normalize parent-directory sequences like '../', enabling attackers to create directories and write files with chosen extensions anywhere the service account has write permissions.

Detection Guidance

Check for suspicious file uploads or directory creation outside the media folder. Inspect POST requests to /api/storage/upload with subDir parameters containing parent-directory sequences like '../'. Review logs for unauthorized file writes in unexpected locations.

Impact Analysis

An attacker could upload malicious files to sensitive system locations, potentially leading to remote code execution, data theft, or system compromise. Since the service account's write permissions determine the impact, files could be placed in critical directories like /etc, /var, or application directories, disrupting services or enabling further attacks.

Compliance Impact

This vulnerability could lead to unauthorized file access or modification, violating data integrity and confidentiality requirements under GDPR and HIPAA. If sensitive data is stored in improperly secured locations, organizations may face compliance violations, legal penalties, and reputational damage due to unauthorized access or data breaches.

Mitigation Strategies

Upgrade ai-fusion-video to a patched version beyond 1.2.0. Implement strict input validation for the subDir parameter to block path traversal sequences. Restrict file upload permissions to prevent writes outside the media directory. Monitor for unauthorized file creation or modification.

Hi! I’m here to help you understand CVE-2026-110212. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70