CVE-2026-114379Medium· 5.4▾ SunlitA flaw has been found in EKKOLearnAI ekko-studio up to 1.0.6. This vulnerability affects the function saveGeneratedImages of the file packages/server/src/modules/studio/controllers/media.ts of the component Media Generation API. This man…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
A flaw has been found in EKKOLearnAI ekko-studio up to 1.0.6. This vulnerability affects the function saveGeneratedImages of the file packages/server/src/modules/studio/controllers/media.ts of the component Media Generation API. This manipulation of the argument output_path causes file inclusion. Remote exploitation of the attack is possible. Patch name: 1d42459c292f89e412f7f6243829e7fed2e85bf5. It is recommended to apply a patch to fix this issue.
ekko-studio 1.0.0ekko-studio 1.0.1ekko-studio 1.0.2ekko-studio 1.0.3ekko-studio 1.0.4ekko-studio 1.0.5ekko-studio 1.0.6Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-111679Medium· 5.4Ekko Studio through 0.7.36 Missing Authorization via /api/auth/locked-ips
CVE-2026-26158High· 7.0A flaw was found in BusyBox
CVE-2026-26157High· 7.0A flaw was found in BusyBox
CVE-2026-114491Medium· 5.3pdfmake 0.3.8 before 0.3.12 Local File Policy Bypass via SVG Images
CVE-2026-114253Medium· 6.3oretnom23 file-management-system-php index.php include file inclusion
CVE-2026-112310Medium· 4.3docling-core 2.5.0 before 2.103.0 Local File Disclosure via Plain Path ImageRef