All vulnerabilities
CVE-2026-114379

EKKOLearnAI ekko-studio Media Generation API media.ts saveGeneratedImages file inclusion

EKKOLearnAI ekko-studio
Open in ThreatlineRecord JSON
CVSS
5.3Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.27%Chance of exploitation activity in the next 30 days, higher than 18% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
Published21 Oct 2026Updated 21 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Description

A flaw has been found in EKKOLearnAI ekko-studio up to 1.0.6. This vulnerability affects the function saveGeneratedImages of the file packages/server/src/modules/studio/controllers/media.ts of the component Media Generation API. This manipulation of the argument output_path causes file inclusion. Remote exploitation of the attack is possible. Patch name: 1d42459c292f89e412f7f6243829e7fed2e85bf5. It is recommended to apply a patch to fix this issue.

Text from CVE List

Affected versions 7

  • ekko-studioaffected: 1.0.0CVE List
  • ekko-studioaffected: 1.0.1CVE List
  • ekko-studioaffected: 1.0.2CVE List
  • ekko-studioaffected: 1.0.3CVE List
  • ekko-studioaffected: 1.0.4CVE List
  • ekko-studioaffected: 1.0.5CVE List
  • ekko-studioaffected: 1.0.6CVE List

References 8