CVE-2026-7086
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
A vulnerability was identified in HBAI-Ltd Toonflow-app up to 1.1.1 affecting the updateStoryboardUrl function in replaceUrl.ts of the Storyboard Export component; manipulation of the url argument leads to path traversal. The attack can be launched remotely and a public exploit may be used. The vendor states the URL is designed to be local or trusted unless the user modifies the code.
Risk Assessment
If the vulnerability is genuine, an attacker may read or write files outside the intended directory, potentially leading to data disclosure or modification.
Recommendation
Verify configuration and restrict the url argument to trusted values; monitor for a vendor patch.
Other vulnerabilities in Toonflow-app
See all- CVE-2026-109526Low
In HBAI-Ltd Toonflow-app up to 1.1.8, an unknown function of the exportData Endpoint component leads to information disclosure. The attack requires local access, and the exploit has been disclosed to the public. Upgrading to version 2.0.0 mitigates this issue. The vendor explains that the report targets version 1.1.8, while the current release 2.0.4 is the result of a substantial architectural refactor and the referenced code paths do not apply.
- CVE-2026-109409Medium
A flaw has been found in HBAI-Ltd Toonflow-app up to 1.1.8. The affected element is the function child_process.exec of the file src/routes/setting/fileManagement/openFolder.ts of the component Open Folder Endpoint. Executing a manipulation of the argument path can lead to command injection. The attack needs to be launched locally. The exploit has been published and may be used. Upgrading to version 2.0.0 is sufficient to fix this issue. You should upgrade the affected component. The vendor explains: "The report targets ToonFlow version 1.1.8. The current release is 2.0.4, which is the result of a substantial architectural refactor; the code paths referenced in the report do not apply to the current version. The report does not describe a vulnerability in any supported release."
- CVE-2026-7085Medium
A vulnerability was determined in HBAI-Ltd Toonflow-app up to 1.1.1 in the z.url function of src/routes/setting/about/downloadApp.ts (downloadApp Endpoint), where manipulation of the url argument causes path traversal. The attack can be initiated remotely, is considered high complexity, and the exploit has been publicly disclosed. The real existence of this vulnerability is still doubted, and the vendor states the update URL is statically compiled in the official repository.
- CVE-2026-7084Medium
A vulnerability was found in HBAI-Ltd Toonflow-app up to 1.1.1. It affects the fetch function of the file src/routes/setting/vendorConfig/getCodeByLink.ts of the getCodeByLink Endpoint component. Manipulation of the Link argument results in server-side request forgery. There is ongoing doubt regarding the real existence of this vulnerability.
Original NVD description (English source)
A vulnerability was identified in HBAI-Ltd Toonflow-app up to 1.1.1. This issue affects the function updateStoryboardUrl of the file replaceUrl.ts of the component Storyboard Export. Such manipulation of the argument url leads to path traversal. It is possible to launch the attack remotely. The exploit is publicly available and might be used. It is still unclear if this vulnerability genuinely exists. The vendor explains in a reply to the issue report, that "[t]he URL of this interface is designed to only be a local address or a trusted domain address configured in docker, and will not contain malicious links, unless the user modifies the code causing unexpected situations."
Vulnerability data from NVD (NIST) · CISA KEV · EPSS