CVE-2026-108772
5.3MediumPublished 11 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-22
Impact
Remote, unauthenticated attackers can read arbitrary files from the server host. They only need network access to the exposed worker cache API endpoint.
Root cause
The download cache handler joins user-supplied file path arguments with filepath.Join without sanitizing directory traversal sequences.
Affected systems
bleenco abstruse up to and including 2.1.0
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Fix & remediation
No fixed version is currently available from the vendor. Block external network access to the worker cache API endpoint or place it behind a reverse proxy that strips path traversal characters.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A security vulnerability has been detected in bleenco abstruse up to 2.1.0. This issue affects the function filepath.Join of the file server/api/worker/download_cache.go of the component Cache Endpoint. Such manipulation of the argument File leads to path traversal. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.