CVE-2026-105037
station-middleware: EnergizeLab Station Middleware Authenticated Path Traversal Arbitrary File Read
EnergizeLab station-middleware
CVSS
9.9CriticalExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.40%Chance of exploitation activity in the next 30 days, higher than 33% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 allow any registered, low-privilege account to read arbitrary files from the server by supplying an attacker-controlled file path. This exposes middleware files and server secrets.
Text from CVE List
Affected versions 1
- station-middlewareaffected: 1.6.5 through 1.8.2CVE List
References 3
- takeonme.org/gcves/GCVE-1337-2026-00000000000000110111111111111111110000000000000000000011111100011111111110000000000000000000011111111111111000000000000000000010001/Advisoryvia CVE List
- github.com/xn0tsa/your-secrets-are-safe-with-meReferencevia CVE List
- theverge.com/tech/1010727/eiliko-robot-hack-energize-labReferencevia CVE List