CVE-2026-51875

Deferred Deferred - Pending Action

BaseFortify

Publication date: 2026-10-01

Last updated on: 2026-10-05

Assigner: MITRE

Description

In Devika v1.0, the Feature Agent save_code_to_project function contains a path traversal vulnerability that allows attackers to write files outside the intended project workspace, potentially compromising the entire server.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-01

Last Modified

2026-10-05

Generated

2026-10-19

AI Q&A

2026-10-02

EPSS Evaluated

2026-10-18

NVD

CVE-2026-51875

EUVD

EUVD-2026-91129

Affected Vendors & Products

Vendor	Product	Version / Range
n/a	n/a	n/a

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability in Devika v1.0 allows attackers to exploit a path traversal flaw in the Feature Agent's save_code_to_project function. This enables them to write files outside the intended project directory, which could lead to unauthorized file creation or system compromise.

Detection Guidance

To detect this vulnerability, inspect Devika v1.0 installations for unauthorized file writes outside project directories. Check server logs for suspicious file operations or path traversal attempts in the Feature Agent component. No specific commands are provided in the context.

Impact Analysis

Attackers could exploit this to overwrite critical system files, execute malicious code, or gain control of the server. This may result in data breaches, service disruption, or complete system takeover depending on the attacker's goals.

Compliance Impact

This vulnerability could lead to unauthorized file writes outside the intended project workspace, potentially exposing sensitive data. This may violate compliance requirements under GDPR (data protection) and HIPAA (health information security) by enabling unauthorized access or disclosure of regulated data.

Mitigation Strategies

Update Devika to the latest version that patches the path traversal vulnerability in the Feature Agent save_code_to_project function. If an update is not available, disable or restrict access to the vulnerable function until a patch is released.

Hi! I’m here to help you understand CVE-2026-51875. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70