CVE-2026-105032

9.1 Critique

Publiée le 15/10/2026 à 23:17 · Modifiée le 16/10/2026 à 22:17 · Analyse NVD reportée · Source : cve@takeonme.org

Description

The EnergizeLab Eilik and EilikO AI skill upload endpoint, served by the FastAPI AI inference and profiling services, does not require authentication and does not constrain uploaded file paths. An unauthenticated remote attacker can use path traversal to write arbitrary files, and thereby tamper with AI skill files used by Eilik and EilikO robots.

Traduire en français

Produits concernés

EnergizeLab FastAPI AI inference server

Scores CVSS

Version	Score	Source	Vecteur
3.1	9.1 Critique	cve@takeonme.org	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H`

Faiblesses (CWE)

CWE-22
CWE-434

Références

https://github.com/xn0tsa/your-secrets-are-safe-with-me
https://takeonme.org/gcves/GCVE-1337-2026-00000000000000000000000000000000000000000000000001011111111110011111111110000000000000000000000000000000000000000000000000000001100/
https://www.theverge.com/tech/1010727/eiliko-robot-hack-energize-lab

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories