CVE-2026-81560
Received Received - Intake

Path Traversal in blackms aistack Static File Handler

Publication date: 2026-08-27

Last updated on: 2026-08-27

Assigner: VulDB

Description
A vulnerability was identified in blackms aistack up to 1.6.1. Affected by this issue is some unknown functionality of the file src/web/server.ts of the component Static File Handler. Such manipulation of the argument req.url leads to path traversal. The attack can be executed remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-27
Last Modified
2026-08-27
Generated
2026-08-27
AI Q&A
2026-08-27
EPSS Evaluated
N/A
NVD
CVE-2026-81560
EUVD
EUVD-2026-66998

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
blackms aistack to 1.6.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a path traversal vulnerability in the blackms aistack project up to version 1.6.1. The issue is in the static file handler in src/web/server.ts where the server uses req.url to construct a file path without proper validation. This allows attackers to manipulate the URL to read files outside the intended static directory by using path traversal sequences like ../.

Detection Guidance

Check if your system runs a vulnerable version of blackms aistack by inspecting the static file handler in src/web/server.ts. Look for path traversal patterns in web server logs, such as requests containing ../ sequences or URL-encoded traversal characters like %2e%2e%2f. Use tools like curl to test for path traversal by sending crafted requests to the web server, e.g., curl http://localhost:PORT/..%2f..%2f..%2fetc%2fpasswd.

Impact Analysis

An attacker could exploit this to read sensitive files on the server that are readable by the web server process. This includes configuration files, source code, or other sensitive data. The impact is primarily on confidentiality as files can be disclosed over HTTP. Integrity and availability impacts are low.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate compliance requirements under GDPR (data protection) and HIPAA (protected health information). Unauthorized file access could result in data breaches, triggering mandatory breach notifications and potential fines.

Mitigation Strategies

Immediately stop using the vulnerable version of blackms aistack. Implement path normalization and strict containment checks in the static file handler to ensure requested file paths remain within the static directory. Use a hardened middleware to serve static files and reject traversal sequences. Add authentication to restrict access to the web server.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-81560. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart