CVE-2026-51906
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
In TaskingAI v0.3.0 in the DALL-E 3 image generation tool save_url_image function, a path traversal vulnerability allows attackers to write downloaded images to arbitrary locations on the server filesystem by manipulating the project_id parameter.
Risk Assessment
The risk for the organization is the possibility of writing malicious files to unauthorized locations, which could lead to server security compromise or code execution.
Recommendation
It is recommended to update TaskingAI to a version that fixes this vulnerability and validate the project_id parameter to prevent path traversal.
Other vulnerabilities in TaskingAI
See all- CVE-2026-111321Medium
TaskingAI through 0.3.0 contains a server-side request forgery vulnerability that allows authenticated attackers to make the backend send arbitrary HTTP requests by supplying an unvalidated OpenAPI servers[0].url in a user-defined action. Attackers holding a project API key or console admin login can create an action pointing to loopback, internal or cloud metadata addresses and run it via POST /actions/{action_id}/run to read back up to 64 KiB of responses.
- CVE-2026-51907High
In TaskingAI v0.3.0 in the QR Code Generator plugin save_base64_image function, a path traversal vulnerability allows attackers to write image files to arbitrary locations on the server filesystem by manipulating the project_id parameter.
Original NVD description (English source)
In TaskingAI v0.3.0 in the DALL-E 3 image generation tool save_url_image function, a path traversal vulnerability allows attackers to write downloaded images to arbitrary locations on the server filesystem by manipulating the project_id parameter.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS