{"id":"EUVD-2026-60972","revision":"07a9845a8e9c49519af98b4fcf406d00","records":[{"revision":"07a9845a8e9c49519af98b4fcf406d00","observedAt":"2026-10-28T09:41:33.422+00:00","statement":{"source":"euvd","id":"EUVD-2026-60972","aliases":["CVE-2026-75914","GHSA-w7wx-5q49-r59w"],"title":"CodeWhale versions before 0.8.64 contain a path traversal vulnerability in the image_analyze tool that fails to canonicalize symlinks before reading files. Attackers can create workspace symlinks pointing to external files with image extens…","description":"CodeWhale versions before 0.8.64 contain a path traversal vulnerability in the image_analyze tool that fails to canonicalize symlinks before reading files. Attackers can create workspace symlinks pointing to external files with image extensions to leak file bytes to the vision endpoint without user approval.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","score":8.7,"severity":null}],"references":["https://github.com/Hmbown/CodeWhale/security/advisories/GHSA-w7wx-5q49-r59w","https://github.com/Hmbown/CodeWhale/commit/26de44a8bd5051f8f944ea60b2c37ae1d2b7d25e","https://www.vulncheck.com/advisories/codewhale-before-path-traversal-via-image-analyze-symlink"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-60972","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Aug 18, 2026, 3:22:02 PM","dateUpdated":"Aug 20, 2026, 3:24:01 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-60972","identifiers":["EUVD-2026-60972","CVE-2026-75914","GHSA-w7wx-5q49-r59w"]},"retained":false,"historicalAffected":[]}],"coverage":[]}