---
id: "CVE-2026-116046"
kind: "vulnerability"
aliases: ["CVE-2026-116046"]
title: "EventCatalog SDK: path traversal in custom docs helpers lets callers write outside intended directory"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["documentation-tooling", "eventcatalog", "node", "npm", "package"]
not_affected_if: ["no-untrusted-input-to-custom-doc-path", "version-2.30.0-or-later"]
published_at: "2026-10-25T07:16:47+00:00"
first_seen_at: "2026-10-25T07:39:10+00:00"
updated_at: "2026-10-25T07:39:16+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116046", "first_seen_at": "2026-10-25T07:39:10+00:00"}]
---

# EventCatalog SDK: path traversal in custom docs helpers lets callers write outside intended directory

The EventCatalog SDK up to 2.29.0 has a path traversal flaw in its custom documentation helpers, where the options.path argument is not sanitized. An attacker who can supply that path can read, write or delete files outside the intended documentation folder on the local host.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed SDK version with `npm ls @eventcatalog/sdk` (package name assumed from the sources' product name; confirm in the project).
- Flag any version at or below `2.29.0` as affected.

## Fix

- Upgrade the EventCatalog SDK to `2.30.0` or later.

## Timeline

- 2026-10-25T07:39:10+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116046

## From the sources

A flaw has been found in eventcatalog sdk up to 2.29.0. This vulnerability affects the function getCustomDoc/writeCustomDoc/rmCustomDoc of the file packages/sdk/src/custom-docs.ts of the component Custom Documentation Helpers. This manipulation of the argument options.path causes path traversal. It is possible to launch the attack on the local host. Upgrading to version 2.30.0 is able to resolve this issue. Patch name: a4f072a03f440d58230092e88d8b4893f4c6d6ca. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_