CVE-2026-116046

eventcatalog sdk Custom Documentation Helpers custom-docs.ts rmCustomDoc path traversal

eventcatalog sdk

Open in Threatline Record JSON

CVSS

4.8Medium

ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV

Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet

Fixed inNone listedNo source names a fixed version. Check the vendor advisory below

Published25 Oct 2026Updated 25 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Reports 1

1 outlet mention it. Reports are not confirmation; each links to its source.

🚨 CVE-2026-116046 A flaw has been found in eventcatalog sdk up to 2.29.0. This vulnerability affects the function getCustomDoc/writeCustomDoc/rmCustomDoc of the file packages/sdk/src/custom-docs.ts ofTelegram: CVE Notify, 25 Oct 2026

Description

A flaw has been found in eventcatalog sdk up to 2.29.0. This vulnerability affects the function getCustomDoc/writeCustomDoc/rmCustomDoc of the file packages/sdk/src/custom-docs.ts of the component Custom Documentation Helpers. This manipulation of the argument options.path causes path traversal. It is possible to launch the attack on the local host. Upgrading to version 2.30.0 is able to resolve this issue. Patch name: a4f072a03f440d58230092e88d8b4893f4c6d6ca. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Text from CVE List

Affected versions 30

sdkaffected: 2.0CVE List
sdkaffected: 2.1CVE List
sdkaffected: 2.2CVE List
sdkaffected: 2.3CVE List
sdkaffected: 2.4CVE List
sdkaffected: 2.5CVE List
sdkaffected: 2.6CVE List
sdkaffected: 2.7CVE List
sdkaffected: 2.8CVE List
sdkaffected: 2.9CVE List
sdkaffected: 2.10CVE List
sdkaffected: 2.11CVE List
sdkaffected: 2.12CVE List
sdkaffected: 2.13CVE List
sdkaffected: 2.14CVE List
sdkaffected: 2.15CVE List
sdkaffected: 2.16CVE List
sdkaffected: 2.17CVE List
sdkaffected: 2.18CVE List
sdkaffected: 2.19CVE List
sdkaffected: 2.20CVE List
sdkaffected: 2.21CVE List
sdkaffected: 2.22CVE List
sdkaffected: 2.23CVE List
sdkaffected: 2.24CVE List
sdkaffected: 2.25CVE List
sdkaffected: 2.26CVE List
sdkaffected: 2.27CVE List
sdkaffected: 2.28CVE List
sdkaffected: 2.29.0CVE List