Path Traversal Vulnerability in ai-fusion-video by Stonewuu

CVE-2026-110212

What is CVE-2026-110212?

The ai-fusion-video application by Stonewuu, up to version 1.2.0, suffers from a path traversal vulnerability that permits authenticated users to bypass file upload restrictions. This vulnerability allows an attacker to leverage the subDir parameter in POST /api/storage/upload to write malicious files outside of the intended media directory. By using parent-directory traversal sequences, the LocalStorageStrategy.storeBytes function fails to properly normalize file paths, enabling an attacker to create arbitrary directories and save files with uncontrolled extensions wherever the application has permission to write. This critical oversight poses significant security risks, including unauthorized file access and potential code execution.

References