Live › vulnerability › CVE-2026-116046
Go to dashboardThe EventCatalog SDK up to 2.29.0 has a path traversal flaw in its custom documentation helpers, where the options.path argument is not sanitized. An attacker who can supply that path can read, write or delete files outside the intended documentation folder on the local host.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 07:39 UTC. All times on this page are UTC.
Teams that use the EventCatalog SDK version 2.29.0 or earlier and call the custom documentation helpers (getCustomDoc, writeCustomDoc, rmCustomDoc) with a path that comes from untrusted input. The sources describe the attack as local, so exposure depends on whether untrusted input reaches options.path.
No product ranges from the sources yet.
npm ls @eventcatalog/sdk (package name assumed from the sources' product name; confirm in the project).2.29.0 as affected.2.30.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw has been found in eventcatalog sdk up to 2.29.0. This vulnerability affects the function getCustomDoc/writeCustomDoc/rmCustomDoc of the file packages/sdk/src/custom-docs.ts of the component Custom Documentation Helpers. This manipulation of the argument options.path causes path traversal. It is possible to launch the attack on the local host. Upgrading to version 2.30.0 is able to resolve this issue. Patch name: a4f072a03f440d58230092e88d8b4893f4c6d6ca. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
This page as .md · .json · in your agent: get_signal("CVE-2026-116046")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.