{"id":"CVE-2026-114379","kind":"vulnerability","aliases":["CVE-2026-114379"],"related":[],"title":"EKKOLearnAI ekko-studio: output_path argument allows remote file inclusion","description":"A flaw has been found in EKKOLearnAI ekko-studio up to 1.0.6. This vulnerability affects the function saveGeneratedImages of the file packages/server/src/modules/studio/controllers/media.ts of the component Media Generation API. This manipulation of the argument output_path causes file inclusion. Remote exploitation of the attack is possible. Patch name: 1d42459c292f89e412f7f6243829e7fed2e85bf5. It is recommended to apply a patch to fix this issue.","summary":"The saveGeneratedImages function in the Media Generation API of EKKOLearnAI ekko-studio up to 1.0.6 does not safely handle the output_path argument, enabling file inclusion. A remote attacker can exploit it over the network to read or include files on the server.","severity":"medium","cvss":5.5,"epss":0.00272,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-apps","ai-tooling","ekko-studio","node","self-hosted"],"not_affected_if":["patched-version"],"how_to_check":"- Check the installed ekko-studio version against `1.0.6`; versions up to and including it are listed as affected.\n- Look at `packages/server/src/modules/studio/controllers/media.ts` and confirm whether `saveGeneratedImages` still uses the raw `output_path` argument.","fix":"- Apply the upstream patch `1d42459c292f89e412f7f6243829e7fed2e85bf5` to ekko-studio.\n- Until patched, restrict access to the Media Generation API to trusted users.","status":"open","published_at":"2026-10-21T21:17:57+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-25T04:10:46+00:00","updated_at":"2026-10-25T04:10:46+00:00","category":"ai-tooling","confidence":0.5,"triage":{"at":"2026-10-25T04:10:46Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the upstream patch `1d42459c292f89e412f7f6243829e7fed2e85bf5` to ekko-studio.\n- Until patched, restrict access to the Media Generation API to trusted users.","reach":"internet","title":"EKKOLearnAI ekko-studio: output_path argument allows remote file inclusion","impact":"medium","summary":"The saveGeneratedImages function in the Media Generation API of EKKOLearnAI ekko-studio up to 1.0.6 does not safely handle the output_path argument, enabling file inclusion. A remote attacker can exploit it over the network to read or include files on the server.","category":"ai-tooling","nicknames":[],"who_cares":["ekko-studio","self-hosted","ai-apps","node"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker includes server files via output_path, possibly reading secrets","analyst_note":"Confirm whether the endpoint requires authentication and whether file inclusion leads to code execution; check the NVD entry and the linked patch commit.","how_to_check":"- Check the installed ekko-studio version against `1.0.6`; versions up to and including it are listed as affected.\n- Look at `packages/server/src/modules/studio/controllers/media.ts` and confirm whether `saveGeneratedImages` still uses the raw `output_path` argument.","needs_analyst":true,"not_affected_if":["patched-version"],"who_is_affected":"Teams running EKKOLearnAI ekko-studio up to version 1.0.6 with the Media Generation API exposed. The sources do not describe which deployments or roles are needed beyond remote reachability, so deployments that do not run this version or do not expose the Media Generation API can likely skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000663,"input_tokens":3422,"output_tokens":642,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-114379':14A,17A '-2026':13A,16A '1.0.6':46B,87C '1d42459c292f89e412f7f6243829e7fed2e85bf5':123C 'affect':90C 'ai':19B,22B 'ai-app':18B 'ai-tool':21B 'allow':8A 'api':38B,103C 'app':20B 'appli':128C 'argument':7A,54B,108C 'attack':60B,118C 'caus':111C 'compon':100C 'cve':12A,15A 'ekko':3A,25B,42B,83C 'ekko-studio':2A,24B,41B,82C 'ekkolearnai':1A,40B,81C 'enabl':55B 'exploit':62B,115C 'file':10A,56B,71B,96C,112C 'fix':132C 'flaw':76C 'found':79C 'function':33B,92C 'generat':37B,102C 'handl':50B 'host':30B 'includ':70B 'inclus':11A,57B,113C 'issu':134C 'manipul':105C 'media':36B,101C 'name':122C 'network':66B 'node':27B 'output':5A,52B,109C 'packages/server/src/modules/studio/controllers/media.ts':97C 'patch':121C,130C 'path':6A,53B,110C 'possibl':120C 'read':68B 'recommend':126C 'remot':9A,59B,114C 'safe':49B 'savegeneratedimag':32B,93C 'self':29B 'self-host':28B 'server':74B 'studio':4A,26B,43B,84C 'tool':23B 'vulner':89C","nicknames":[],"mitigations":[],"who_affected":"Teams running EKKOLearnAI ekko-studio up to version 1.0.6 with the Media Generation API exposed. The sources do not describe which deployments or roles are needed beyond remote reachability, so deployments that do not run this version or do not expose the Media Generation API can likely skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T21:17:57+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114379","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114379","severity":null,"published_at":"2026-10-21T21:17:57+00:00","modified_at":"2026-10-22T15:15:23+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114379","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114379","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}