CVE-2026-8765CWE-22path-traversal

CVE-2026-8765

Medium · published May 18, 2026

CVSS v3.1
4.3
EPSS
1%
Percentile
47.0
In the wild
Unconfirmed
What it is

A vulnerability was detected in Kilo-Org kilocode up to 7.0.47. This vulnerability affects the function Bun.file of the file packages/opencode/src/kilocode/review/worktree-diff.ts of the component File Diff API Endpoint. Performing a manipulation of the argument File results in path traversal. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00580 · 47.0th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-05-18T03:17Z
Affected products (1)
ProductVersionsFixed in
kilo/kilo_code≥ 7.0.0, ≤ 7.0.47—
References (4)
https://gist.github.com/YLChen-007/1770f4530b0c933dc61f15b02aa0629d · [email protected]https://vuldb.com/submit/811401 · [email protected]https://vuldb.com/vuln/364390 · [email protected]https://vuldb.com/vuln/364390/cti · [email protected]
EPSS history
Timeline
  • 17 MAY 22:00Z
    Kilo-Org kilocode File Diff API Endpoint worktree-diff.ts Bun.file path traversal
    cvelistv5