{"id":"CVE-2026-51906","title":"In TaskingAI v0.3.0 in the DALL-E 3 image generation tool save_url_image function, a path traversal vulnerability allows attackers to write downloaded images to arbitrary locations on the server filesystem by manipulating the project_id …","summary":"In TaskingAI v0.3.0 in the DALL-E 3 image generation tool save_url_image function, a path traversal vulnerability allows attackers to write downloaded images to arbitrary locations on the server filesystem by manipulating the project_id …","severity":"none","published":"2026-10-02","updated":"2026-10-02","sourceUpdated":"2026-10-02T16:16:50.207","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-51906","references":[{"url":"https://gist.github.com/Ro1ME/3430171ed3a7e6c42864f45b59c203cf","label":"cve@mitre.org"},{"url":"https://github.com/TaskingAI/TaskingAI/issues/375","label":"cve@mitre.org"}],"tags":["nvd","cve.org"],"ingestedAt":"2026-10-02T16:22:59.532Z","slug":"CVE-2026-51906","body":"## Overview\n\nIn TaskingAI v0.3.0 in the DALL-E 3 image generation tool save_url_image function, a path traversal vulnerability allows attackers to write downloaded images to arbitrary locations on the server filesystem by manipulating the project_id parameter.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}