Vulnerability record/PUBLISHED/Published Oct 25, 2026 06:45:08 UTC

CVE-2026-116046

A flaw has been found in eventcatalog sdk up to 2.29.0. This vulnerability affects the function getCustomDoc/writeCustomDoc/rmCustomDoc of the file packages/sdk/src/custom-docs.ts of the component Custom Documentation Helpers. This manipulation of the argument options.path causes path traversal. It is possible to launch the attack on the local host. Upgrading to version 2.30.0 is able to resolve this issue. Patch name: a4f072a03f440d58230092e88d8b4893f4c6d6ca. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Base score4.8/ 10

SeverityMediumCVSS 4.0

Exploitability / impact

CVSS metric breakdown

Vector-derived attributes

Base severityMedium

Attack vectorLocalAV

Attack complexityLowAC

Attack requirementsNoneAT

Privileges requiredLowPR

User interactionNoneUI

Vulnerable system confidentialityLowVC

Vulnerable system integrityLowVI

Vulnerable system availabilityLowVA

Subsequent system confidentialityNoneSC

Subsequent system integrityNoneSI

Subsequent system availabilityNoneSA

Exploit maturityNot definedE

CVSS vector stringCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X

CVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.

Record context

CVE Numbering AuthorityVulDB

Last updatedOct 25, 2026 06:45:08 UTC

PublishedOct 25, 2026 06:45:08 UTC

ReservedOct 24, 2026 13:57:18 UTC

Credits

pure (VulDB User)
VulDB CNA Team