CVE-2026-101080

MediumCVSS 4.8

Published: 28/09/2026(UTC)Updated: 28/09/2026(UTC)Translated: 28/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.14%

3th percentile - higher than 3% of all known CVEs

Summary

A vulnerability was identified in Tencent AI-Infra-Guard up to 4.5.2/4.6.2. The startsWith function in skill_scan/tools/dir/dir_actions.py of the File Access component leads to path traversal. The attack needs to be performed locally. The exploit is publicly available. Upgrading to version 4.6.0 mitigates this issue.

Risk Assessment

A local attack can allow access to files outside the intended directory, potentially leading to data disclosure or privilege escalation.

Recommendation

Upgrade to version 4.6.0 or later and apply the patch with identifier ac0384edc9dbea3b226edefcf50613bd8509134f.

Other vulnerabilities in Tencent AI-Infra-Guard

CVE-2026-84809Medium
Tencent AI-Infra-Guard's skill-scan component excludes compiled Python bytecode files from analysis by hardcoding __pycache__ directories and .pyc/.pyo/.pyd extensions into skip lists across multiple scanning surfaces. Attackers can distribute skills with benign Python source files alongside malicious compiled bytecode that executes on import while the scanner reports a safe verdict, enabling code execution when operators install the skill.

Original NVD description (English source)

A vulnerability was identified in Tencent AI-Infra-Guard up to 4.5.2/4.6.2. This affects the function startsWith of the file skill_scan/tools/dir/dir_actions.py of the component File Access. The manipulation leads to path traversal. The attack needs to be performed locally. The exploit is publicly available and might be used. Upgrading to version 4.6.0 is able to mitigate this issue. The identifier of the patch is ac0384edc9dbea3b226edefcf50613bd8509134f. You should upgrade the affected component.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS