{"id":"CVE-2026-116046","kind":"vulnerability","aliases":["CVE-2026-116046"],"related":[],"title":"EventCatalog SDK: path traversal in custom docs helpers lets callers write outside intended directory","description":"A flaw has been found in eventcatalog sdk up to 2.29.0. This vulnerability affects the function getCustomDoc/writeCustomDoc/rmCustomDoc of the file packages/sdk/src/custom-docs.ts of the component Custom Documentation Helpers. This manipulation of the argument options.path causes path traversal. It is possible to launch the attack on the local host. Upgrading to version 2.30.0 is able to resolve this issue. Patch name: a4f072a03f440d58230092e88d8b4893f4c6d6ca. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.","summary":"The EventCatalog SDK up to 2.29.0 has a path traversal flaw in its custom documentation helpers, where the options.path argument is not sanitized. An attacker who can supply that path can read, write or delete files outside the intended documentation folder on the local host.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["documentation-tooling","eventcatalog","node","npm","package"],"not_affected_if":["no-untrusted-input-to-custom-doc-path","version-2.30.0-or-later"],"how_to_check":"- Check the installed SDK version with `npm ls @eventcatalog/sdk` (package name assumed from the sources' product name; confirm in the project).\n- Flag any version at or below `2.29.0` as affected.","fix":"- Upgrade the EventCatalog SDK to `2.30.0` or later.","status":"open","published_at":"2026-10-25T07:16:47+00:00","first_seen_at":"2026-10-25T07:39:10+00:00","triaged_at":"2026-10-25T07:39:16+00:00","updated_at":"2026-10-25T07:39:16+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T07:39:16Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the EventCatalog SDK to `2.30.0` or later.","reach":"local","title":"EventCatalog SDK: path traversal in custom docs helpers lets callers write outside intended directory","impact":"medium","summary":"The EventCatalog SDK up to 2.29.0 has a path traversal flaw in its custom documentation helpers, where the options.path argument is not sanitized. An attacker who can supply that path can read, write or delete files outside the intended documentation folder on the local host.","category":"package","nicknames":[],"who_cares":["eventcatalog","npm","node","documentation-tooling"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Files outside the docs folder can be read, overwritten or deleted.","analyst_note":"","how_to_check":"- Check the installed SDK version with `npm ls @eventcatalog/sdk` (package name assumed from the sources' product name; confirm in the project).\n- Flag any version at or below `2.29.0` as affected.","needs_analyst":false,"not_affected_if":["version-2.30.0-or-later","no-untrusted-input-to-custom-doc-path"],"who_is_affected":"Teams that use the EventCatalog SDK version 2.29.0 or earlier and call the custom documentation helpers (getCustomDoc, writeCustomDoc, rmCustomDoc) with a path that comes from untrusted input. The sources describe the attack as local, so exposure depends on whether untrusted input reaches options.path.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000624,"input_tokens":3438,"output_tokens":561,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116046':17A,20A '-2026':16A,19A '2.29.0':33B,83C '2.30.0':123C 'a4f072a03f440d58230092e88d8b4893f4c6d6ca':132C 'abl':125C 'affect':86C,134C,158C 'argument':47B,104C 'attack':52B,115C 'caller':10A 'caus':106C 'compon':96C,135C 'contact':142C 'custom':6A,41B,97C 'cve':15A,18A 'delet':62B 'directori':14A 'doc':7A 'document':22B,42B,67B,98C 'documentation-tool':21B 'earli':143C 'eventcatalog':1A,24B,29B,79C 'file':63B,92C 'fix':154C 'flaw':38B,74C 'folder':68B 'found':77C 'function':88C 'getcustomdoc/writecustomdoc/rmcustomdoc':89C 'helper':8A,43B,99C 'host':72B,119C 'intend':13A,66B 'issu':129C 'launch':113C 'let':9A 'local':71B,118C 'manipul':101C 'manner':149C 'name':131C 'node':25B 'npm':26B 'options.path':46B,105C 'outsid':12A,64B 'packag':27B 'packages/sdk/src/custom-docs.ts':93C 'patch':130C 'path':3A,36B,57B,107C 'possibl':111C 'product':159C 'profession':148C 'quick':151C 'read':59B 'releas':152C 'resolv':127C 'respond':144C 'sanit':50B 'sdk':2A,30B,80C 'suppli':55B 'tool':23B 'travers':4A,37B,108C 'upgrad':120C,138C 'vendor':140C 'version':122C,155C 'vulner':85C 'write':11A,60B","nicknames":[],"mitigations":[],"who_affected":"Teams that use the EventCatalog SDK version 2.29.0 or earlier and call the custom documentation helpers (getCustomDoc, writeCustomDoc, rmCustomDoc) with a path that comes from untrusted input. The sources describe the attack as local, so exposure depends on whether untrusted input reaches options.path.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-25T07:16:47+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116046","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116046","severity":null,"published_at":"2026-10-25T07:16:47+00:00","modified_at":"2026-10-25T07:16:47+00:00","first_seen_at":"2026-10-25T07:39:10+00:00","fetched_at":"2026-10-25T07:39:10+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}