Path Traversal Vulnerability in EventCatalog SDK by EventCatalog
CVE-2026-116046

4.8MEDIUM

Key Information:

Vendor

Eventcatalog

Status
Sdk
Vendor
CVE Published:
25 October 2026

What is CVE-2026-116046?

A vulnerability has been identified in EventCatalog SDK versions up to 2.29.0, whereby improper handling of the argument options.path within the Custom Documentation Helpers allows for path traversal manipulation. This flaw can be exploited when locally accessing the affected functions getCustomDoc, writeCustomDoc, and rmCustomDoc, possibly enabling unauthorized file access. Users are advised to upgrade to version 2.30.0 or later, where the issue has been addressed, ensuring enhanced security for the product.

Affected Version(s)

sdk 2.0

sdk 2.1

sdk 2.2

References

https://vuldb.com/vuln/426122
vdb-entrytechnical-description
https://vuldb.com/vuln/426122/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-116046
third-party-advisory

CVSS V4

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

pure (VulDB User)
VulDB CNA Team
.