All vulnerabilities
CVE-2026-101080

Tencent AI-Infra-Guard File Access dir_actions.py startsWith path traversal

Tencent AI-Infra-Guard
Open in ThreatlineRecord JSON
CVSS
2.4Low
ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 28 Sep 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.14%Chance of exploitation activity in the next 30 days, higher than 2% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
Published28 Sep 2026Updated 28 Sep 2026CVE List

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Description

A vulnerability was identified in Tencent AI-Infra-Guard up to 4.5.2/4.6.2. This affects the function startsWith of the file skill_scan/tools/dir/dir_actions.py of the component File Access. The manipulation leads to path traversal. The attack needs to be performed locally. The exploit is publicly available and might be used. Upgrading to version 4.6.0 is able to mitigate this issue. The identifier of the patch is ac0384edc9dbea3b226edefcf50613bd8509134f. You should upgrade the affected component.

Text from CVE List

Affected versions 7

  • AI-Infra-Guardaffected: 4.5.0CVE List
  • AI-Infra-Guardaffected: 4.5.1CVE List
  • AI-Infra-Guardaffected: 4.5.2CVE List
  • AI-Infra-Guardaffected: 4.6.0CVE List
  • AI-Infra-Guardaffected: 4.6.1CVE List
  • AI-Infra-Guardaffected: 4.6.2CVE List
  • AI-Infra-Guardunaffected: 4.6.0CVE List

References 9