CVE-2026-5258CWE-22

Sanster IOPaint File Manager file_manager.py _get_file path traversal

Medium · published April 1, 2026

CVSS v4.0
6.9
EPSS
1%
Percentile
53.3
In the wild
Unconfirmed
What it is

A vulnerability was found in Sanster IOPaint 1.5.3. Impacted is the function _get_file of the file iopaint/file_manager/file_manager.py of the component File Manager. Performing a manipulation of the argument filename results in path traversal. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

The record
Technical detail
CVSS v4.0
6.9 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.00718 · 53.3th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-04-01T06:45Z
EPSS history
Timeline
  • 01 APR 06:45Z
    Sanster IOPaint File Manager file_manager.py _get_file path traversal
    cvelistv5