CVE-2026-116046
Received Received - Intake

Path Traversal in EventCatalog SDK

Publication date: 2026-10-25

Last updated on: 2026-10-25

Assigner: VulDB

Description
A flaw has been found in eventcatalog sdk up to 2.29.0. This vulnerability affects the function getCustomDoc/writeCustomDoc/rmCustomDoc of the file packages/sdk/src/custom-docs.ts of the component Custom Documentation Helpers. This manipulation of the argument options.path causes path traversal. It is possible to launch the attack on the local host. Upgrading to version 2.30.0 is able to resolve this issue. Patch name: a4f072a03f440d58230092e88d8b4893f4c6d6ca. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-25
Last Modified
2026-10-25
Generated
2026-10-25
AI Q&A
2026-10-25
EPSS Evaluated
N/A
NVD
CVE-2026-116046
EUVD
EUVD-2026-109370

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a path traversal flaw in the EventCatalog SDK up to version 2.29.0. It affects functions like getCustomDoc, writeCustomDoc, and rmCustomDoc in the custom-docs.ts file. The issue allows attackers to manipulate the options.path argument to access or modify files outside the intended catalog directory by using path traversal techniques such as .. or absolute paths. The vendor has released version 2.30.0 to fix this issue.

Impact Analysis

This vulnerability could allow an attacker to read, write, or delete files outside the intended catalog directory on the local host. If exploited, it may lead to unauthorized access to sensitive files, data corruption, or system compromise, depending on the permissions of the running process.

Mitigation Strategies

Upgrade the EventCatalog SDK to version 2.30.0 or later to resolve the path traversal vulnerability. Verify the installation by checking the version and ensuring the fix is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116046. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart