CVE-2026-75333CWE-22path-traversal

CVE-2026-75333

High · published August 27, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
42.1
In the wild
Unconfirmed
What it is

yx-image-recognition v1.0 is vulnerable to Path Traversal. Parameters such as dir, filePath are directly passed to new File() for file system operations without any path sanitization or whitelist validation.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00503 · 42.1th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-08-27T02:16Z
References (2)
https://github.com/fangtang7/CVE/blob/main/yx-image-recognition/PATH_TRAVERSAL_REPORT.md · [email protected]https://github.com/fangtang7/CVE/blob/main/yx-image-recognition/PATH_TRAVERSAL_REPORT.md · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 28 AUG 06:53Z
    EPSS moved — → 0%
    epss
  • 26 AUG 00:00Z
    yx-image-recognition v1.0 is vulnerable to Path Traversal
    cvelistv5