{"id":"CVE-2026-51907","title":"In TaskingAI v0.3.0 in the QR Code Generator plugin save_base64_image function, a path traversal vulnerability allows attackers to write image files to arbitrary locations on the server filesystem by manipulating the project_id parameter.","summary":"In TaskingAI v0.3.0 in the QR Code Generator plugin save_base64_image function, a path traversal vulnerability allows attackers to write image files to arbitrary locations on the server filesystem by manipulating the project_id parameter.","severity":"none","published":"2026-10-02","updated":"2026-10-02","sourceUpdated":"2026-10-02T16:16:50.320","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-51907","references":[{"url":"https://gist.github.com/Ro1ME/357950ddd2f65566b1b33525651b5635","label":"cve@mitre.org"},{"url":"https://github.com/TaskingAI/TaskingAI/issues/374","label":"cve@mitre.org"}],"tags":["nvd","cve.org"],"ingestedAt":"2026-10-02T16:22:59.533Z","slug":"CVE-2026-51907","body":"## Overview\n\nIn TaskingAI v0.3.0 in the QR Code Generator plugin save_base64_image function, a path traversal vulnerability allows attackers to write image files to arbitrary locations on the server filesystem by manipulating the project_id parameter.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}