CVE-2026-51906
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
In TaskingAI v0.3.0 in the DALL-E 3 image generation tool save_url_image function, a path traversal vulnerability allows attackers to write downloaded images to arbitrary locations on the server filesystem by manipulating the project_id parameter.
Risk Assessment
The risk for the organization is the possibility of writing malicious files to unauthorized locations, which could lead to server security compromise or code execution.
Recommendation
It is recommended to update TaskingAI to a version that fixes this vulnerability and validate the project_id parameter to prevent path traversal.
Other vulnerabilities in TaskingAI
Original NVD description (English source)
In TaskingAI v0.3.0 in the DALL-E 3 image generation tool save_url_image function, a path traversal vulnerability allows attackers to write downloaded images to arbitrary locations on the server filesystem by manipulating the project_id parameter.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS