CVE-2026-10044CWE-36

ai-goofish-monitor Unauthenticated Arbitrary File Read via GET /api/prompts/

High · published May 28, 2026

CVSS v4.0
8.2
EPSS
1%
Percentile
48.0
In the wild
Unconfirmed
What it is

Usagi-org ai-goofish-monitor contains an unauthenticated arbitrary file read vulnerability in the GET /api/prompts/{filename} endpoint on Windows deployments that allows unauthenticated remote attackers to read arbitrary files by supplying absolute Windows paths or backslash-based traversal sequences. Attackers can bypass the incomplete path traversal guard, which only blocks forward slashes and '..', by providing absolute paths such as Windows system file locations, causing os.path.join to discard the intended prompts directory prefix and expose files accessible to the application process.

The record
Technical detail
CVSS v4.0
8.2 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00600 · 48.0th percentile
Weakness
CWE-36 · Absolute Path Traversal
Published
2026-05-28T21:02Z
EPSS history
Timeline
  • 28 MAY 21:02Z
    ai-goofish-monitor Unauthenticated Arbitrary File Read via GET /api/prompts/
    cvelistv5