CVE-2026-105032
9.1CriticalPublished 15 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on integrity, availability
- Weakness
- CWE-22, CWE-434
Impact
Unauthenticated remote attackers can overwrite arbitrary files and tamper with robot skill files. Attackers only need network access to the exposed FastAPI AI inference and profiling service.
Root cause
The AI skill upload endpoint lacks authentication and fails to sanitize upload paths, enabling arbitrary file writes via path traversal.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Fix & remediation
Block network access to the FastAPI AI skill upload endpoint or shut down the service until a vendor patch is released.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
The EnergizeLab Eilik and EilikO AI skill upload endpoint, served by the FastAPI AI inference and profiling services, does not require authentication and does not constrain uploaded file paths. An unauthenticated remote attacker can use path traversal to write arbitrary files, and thereby tamper with AI skill files used by Eilik and EilikO robots.