Live › vulnerability › CVE-2026-114379
Go to dashboardThe saveGeneratedImages function in the Media Generation API of EKKOLearnAI ekko-studio up to 1.0.6 does not safely handle the output_path argument, enabling file inclusion. A remote attacker can exploit it over the network to read or include files on the server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running EKKOLearnAI ekko-studio up to version 1.0.6 with the Media Generation API exposed. The sources do not describe which deployments or roles are needed beyond remote reachability, so deployments that do not run this version or do not expose the Media Generation API can likely skip it.
No product ranges from the sources yet.
1.0.6; versions up to and including it are listed as affected.packages/server/src/modules/studio/controllers/media.ts and confirm whether saveGeneratedImages still uses the raw output_path argument.1d42459c292f89e412f7f6243829e7fed2e85bf5 to ekko-studio.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw has been found in EKKOLearnAI ekko-studio up to 1.0.6. This vulnerability affects the function saveGeneratedImages of the file packages/server/src/modules/studio/controllers/media.ts of the component Media Generation API. This manipulation of the argument output_path causes file inclusion. Remote exploitation of the attack is possible. Patch name: 1d42459c292f89e412f7f6243829e7fed2e85bf5. It is recommended to apply a patch to fix this issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-114379")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.