CVE-2026-90691
Received Received - Intake

Path Traversal in HexStrike AI API Files Endpoint

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: VulDB

Description
A security vulnerability has been detected in 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04. The impacted element is the function FileOperationsManager of the file hexstrike_server.py of the component API Files Endpoint. The manipulation of the argument filename leads to path traversal. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-14
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-90691
EUVD
EUVD-2026-77244

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
0x4m4 hexstrike_ai to d689933ff579d839c676c82b231f8e98326c5f04 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a path traversal vulnerability in HexStrike AI up to version d689933ff579d839c676c82b231f8e98326c5f04. The FileOperationsManager function in hexstrike_server.py improperly handles the filename argument, allowing attackers to traverse outside the intended directory using sequences like ../../../. This can lead to writing files to arbitrary locations on the server.

Detection Guidance

Check if HexStrike AI is running and inspect network traffic for requests to /api/files/create or /api/files/modify endpoints with filenames containing ../ or absolute paths. Review server logs for suspicious file writes outside /tmp/hexstrike_files.

Impact Analysis

An attacker could exploit this to write malicious files like web shells, SSH keys, or cron jobs outside the sandbox. This may enable remote code execution, unauthorized system access, or persistent compromise of the server. The server runs without authentication, making exploitation easier.

Compliance Impact

This vulnerability could lead to unauthorized data access, modification, or exfiltration, violating GDPR's integrity and confidentiality requirements and HIPAA's safeguards for protected health information. Non-compliance risks include fines and legal penalties.

Mitigation Strategies

Update HexStrike AI to the latest version with path validation fixes. Block unauthenticated access to /api/files endpoints. Restrict filesystem permissions for the server process. Monitor for unauthorized file writes in sensitive directories.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90691. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart