CVE-2026-7271

Vulnerability

A path traversal vulnerability (CWE-22) exists in the creative-ad-agent-server component of the DV0x creative-ad-agent repository up to commit 751b9e5146604dc65049bd0f62dcbdad6212f8a3. The flaw resides in the /images/:sessionId?/:filename endpoint inside server/sdk-server.ts. User-supplied route parameters (req.params) are used to construct a filesystem path without validating that the resolved path stays within the intended generated-images directory [1][3].

Exploitation

An attacker with network access to the server can send HTTP requests containing encoded path traversal sequences (e.g., %2e%2e/) to read arbitrary files accessible to the server process. The exploit is publicly available in a bug report that includes curl commands demonstrating file reads outside the intended directory, including system files like /etc/hosts [3]. No authentication is required, and the attack can be executed remotely [1][3].

Impact

Successful exploitation allows an attacker to read sensitive files on the host system, including repository configuration, environment files, or other data accessible to the server process. The server may leak secrets or application source code, potentially leading to further compromise [1][3].

Mitigation

The maintainer has published a patch in commit 3d255865a957f3740b8724dd914502c0f44d4970 [2]. Applying this patch is the recommended action to fix the vulnerability. The project follows a rolling release model, so version numbers are not provided [1][2].