CVE-2026-75914CWE-22path-traversal

CVE-2026-75914

High · published August 18, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
44.0
In the wild
Unconfirmed
What it is

CodeWhale versions before 0.8.64 contain a path traversal vulnerability in the image_analyze tool that fails to canonicalize symlinks before reading files. Attackers can create workspace symlinks pointing to external files with image extensions to leak file bytes to the vision endpoint without user approval.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00530 · 44.0th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-08-18T20:18Z
References (3)
https://github.com/Hmbown/CodeWhale/commit/26de44a8bd5051f8f944ea60b2c37ae1d2b7d25e · [email protected]https://github.com/Hmbown/CodeWhale/security/advisories/GHSA-w7wx-5q49-r59w · [email protected]https://www.vulncheck.com/advisories/codewhale-before-path-traversal-via-image-analyze-symlink · [email protected]
EPSS history
Timeline
  • 18 AUG 15:22Z
    CodeWhale before 0.8.64 Path Traversal via image_analyze symlink
    cvelistv5