CVE-2026-51907

31th percentile - higher than 31% of all known CVEs

In TaskingAI v0.3.0 in the QR Code Generator plugin save_base64_image function, a path traversal vulnerability allows attackers to write image files to arbitrary locations on the server filesystem by manipulating the project_id parameter.

The risk for the organization is the possibility of overwriting or placing malicious files in critical server locations, which could lead to system integrity compromise or code execution.

It is recommended to update TaskingAI to a version that fixes this vulnerability and validate the project_id parameter to prevent path traversal.