BoxLite: Path Traversal Vulnerability in boxlite Leads to Arbitrary File Write on the Host

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-46703 · Microsoft / collected KEV context

EUVD-2026-36165

GHSA-f396-4rp4-7v2j

GO-2026-5344

PYSEC-2026-298

RUSTSEC-2026-0148

cve-program · CVE-2026-46703

• https://github.com/boxlite-ai/boxlite/security/advisories/GHSA-f396-4rp4-7v2j
• https://github.com/boxlite-ai/boxlite/releases/tag/v0.9.0

euvd · EUVD-2026-36165

• https://github.com/boxlite-ai/boxlite/security/advisories/GHSA-f396-4rp4-7v2j
• https://github.com/boxlite-ai/boxlite/releases/tag/v0.9.0

nvd · CVE-2026-46703

• https://github.com/boxlite-ai/boxlite/releases/tag/v0.9.0
• https://github.com/boxlite-ai/boxlite/security/advisories/GHSA-f396-4rp4-7v2j

osv · GHSA-f396-4rp4-7v2j

• https://github.com/boxlite-ai/boxlite/security/advisories/GHSA-f396-4rp4-7v2j
• https://nvd.nist.gov/vuln/detail/CVE-2026-46703
• https://github.com/boxlite-ai/boxlite
• https://github.com/boxlite-ai/boxlite/releases/tag/v0.9.0
• https://rustsec.org/advisories/RUSTSEC-2026-0148.html

osv · GO-2026-5344

• https://github.com/boxlite-ai/boxlite/security/advisories/GHSA-f396-4rp4-7v2j
• https://nvd.nist.gov/vuln/detail/CVE-2026-46703
• https://github.com/boxlite-ai/boxlite/releases/tag/v0.9.0
• https://rustsec.org/advisories/RUSTSEC-2026-0148.html

osv · RUSTSEC-2026-0148

• https://crates.io/crates/boxlite
• https://rustsec.org/advisories/RUSTSEC-2026-0148.html
• https://github.com/boxlite-ai/boxlite/pull/429
• https://github.com/boxlite-ai/boxlite/pull/446
• https://github.com/boxlite-ai/boxlite/pull/461

No related operational record is retained in the current change model.