CVE-2026-51859
UnknownSummary
bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to directory traversal in save_download_file (src/backend/bisheng/core/cache/utils.py:290). The vulnerability allows access to files outside the intended area.
Risk Assessment
An attacker can access files outside the permitted directory, potentially resulting in information leakage or data modification. This can compromise confidentiality and integrity.
Recommendation
Upgrade bisheng to a version containing the fix and verify path validation in save_download_file. Restrict access to the file download function for untrusted users.
Other vulnerabilities in bisheng
See all- CVE-2026-51861Unknown
bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to Code Injection in src/backend/bisheng/api/v1/validate.py. The vulnerability allows unauthorized code execution in the application context.
- CVE-2026-51860Unknown
bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to Directory Traversal in src/backend/bisheng/linsight/domain/task_exec.py. The vulnerability allows access to files outside the intended directory.
- CVE-2026-82285High
bisheng through 2.6.0-fix2 contains a server-side request forgery vulnerability in the POST /api/v1/workflow/report/callback endpoint that lacks authentication and applies no URL scheme restrictions or host filtering. Unauthenticated attackers can supply arbitrary URLs to enumerate internal network services and cloud metadata endpoints, then retrieve captured responses from object storage using caller-supplied object names.
- CVE-2026-82278High
BISHENG before 2.6.0 contains a remote code execution vulnerability in the workflow run_once endpoint that allows authenticated users to execute arbitrary Python code. Attackers can submit crafted Code node definitions to the POST /api/v1/workflow/run_once endpoint, which executes them with exec() without sandboxing, gaining access to filesystem, credentials, and internal network resources.
Original NVD description (English source)
bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to directory traversal in save_download_file (src/backend/bisheng/core/cache/utils.py:290).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS