23 Oct 2026 15:48:27 UTC
Tencent AI-Infra-Guard File Access dir_actions.py startsWith path traversal
cve-program · CVE-2026-101080 · Published
CVE-2026-101080
Tencent AI-Infra-Guard File Access dir_actions.py startsWith path traversal
CVSS 4.0 2.4 LOWCVSS 3.1 4.8 MEDIUMCVSS 3.0 4.8 MEDIUMCVSS 2.0 4.3 Check source for fixed versionsKEV status unknown
Historical advisory recorded 23 Oct 2026 15:48:27 UTC. Read the latest advisory.
cve-program · CVE-2026-101080
PublishedA vulnerability was identified in Tencent AI-Infra-Guard up to 4.5.2/4.6.2. This affects the function startsWith of the file skill_scan/tools/dir/dir_actions.py of the component File Access. The manipulation leads to path traversal. The attack needs to be performed locally. The exploit is publicly available and might be used. Upgrading to version 4.6.0 is able to mitigate this issue. The identifier of the patch is ac0384edc9dbea3b226edefcf50613bd8509134f. You should upgrade the affected component.
Read the publisher's advisoryAffected versions, risk and source history
Advisory history
1 saved versionsSee how the publisher's advisory changed over time. Each link opens the version saved at that time. The publisher's update date can differ from the date shown here.
How advisory history works
Each link identifies one complete publisher record. History can include advisories that previously shared an identifier; an identifier removed by a publisher no longer establishes a current relationship. A historical link shows only that record and earlier saved versions. Failed checks and unchanged reads do not create new versions.
This historical link shows only this version and versions saved before it. Browse all advisory history.