CVE-2026-7085
MediumCVSS 5.0Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
A vulnerability was determined in HBAI-Ltd Toonflow-app up to 1.1.1 in the z.url function of src/routes/setting/about/downloadApp.ts (downloadApp Endpoint), where manipulation of the url argument causes path traversal. The attack can be initiated remotely, is considered high complexity, and the exploit has been publicly disclosed. The real existence of this vulnerability is still doubted, and the vendor states the update URL is statically compiled in the official repository.
Risk Assessment
Unauthorized access to files outside the intended directory may be possible, though the reality of the vulnerability is doubtful.
Recommendation
Monitor the vendor's official position and consider restricting access to the endpoint or validating the url argument.
Other vulnerabilities in Toonflow-app
See all- CVE-2026-109526Low
In HBAI-Ltd Toonflow-app up to 1.1.8, an unknown function of the exportData Endpoint component leads to information disclosure. The attack requires local access, and the exploit has been disclosed to the public. Upgrading to version 2.0.0 mitigates this issue. The vendor explains that the report targets version 1.1.8, while the current release 2.0.4 is the result of a substantial architectural refactor and the referenced code paths do not apply.
- CVE-2026-109409Medium
A flaw has been found in HBAI-Ltd Toonflow-app up to 1.1.8. The affected element is the function child_process.exec of the file src/routes/setting/fileManagement/openFolder.ts of the component Open Folder Endpoint. Executing a manipulation of the argument path can lead to command injection. The attack needs to be launched locally. The exploit has been published and may be used. Upgrading to version 2.0.0 is sufficient to fix this issue. You should upgrade the affected component. The vendor explains: "The report targets ToonFlow version 1.1.8. The current release is 2.0.4, which is the result of a substantial architectural refactor; the code paths referenced in the report do not apply to the current version. The report does not describe a vulnerability in any supported release."
- CVE-2026-7086Medium
A vulnerability was identified in HBAI-Ltd Toonflow-app up to 1.1.1 affecting the updateStoryboardUrl function in replaceUrl.ts of the Storyboard Export component; manipulation of the url argument leads to path traversal. The attack can be launched remotely and a public exploit may be used. The vendor states the URL is designed to be local or trusted unless the user modifies the code.
- CVE-2026-7084Medium
A vulnerability was found in HBAI-Ltd Toonflow-app up to 1.1.1. It affects the fetch function of the file src/routes/setting/vendorConfig/getCodeByLink.ts of the getCodeByLink Endpoint component. Manipulation of the Link argument results in server-side request forgery. There is ongoing doubt regarding the real existence of this vulnerability.
Original NVD description (English source)
A vulnerability was determined in HBAI-Ltd Toonflow-app up to 1.1.1. This vulnerability affects the function z.url of the file src/routes/setting/about/downloadApp.ts of the component downloadApp Endpoint. This manipulation of the argument url causes path traversal. It is possible to initiate the attack remotely. The attack is considered to have high complexity. It is stated that the exploitability is difficult. The exploit has been publicly disclosed and may be utilized. The real existence of this vulnerability is still doubted at the moment. The vendor explains in a reply to the issue report, that "[t]his interface is used for online updates, and the update URL has been statically compiled in the official code repository. Unless users modify the code, the requested address will be the official source address."
Vulnerability data from NVD (NIST) · CISA KEV · EPSS