CVE-2026-110212 — ai-fusion-video through 1.2.0 Path Traversal in Media Upload subDir Parameter
Stonewuu ai-fusion-video through 1.2.0 contains a path traversal vulnerability that allows authenticated users to write uploaded files outside the media directory via the subDir…
Published: 2026-10-13 · CVSS: 5.3 · CVSS 4.0
Stonewuu ai-fusion-video through 1.2.0 contains a path traversal vulnerability that allows authenticated users to write uploaded files outside the media directory via the subDir parameter of POST /api/storage/upload. Attackers can supply parent-directory sequences that LocalStorageStrategy.storeBytes never normalizes, creating directories and writing attacker-controlled files with chosen extensions anywhere the service account can write.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7