Directory Traversal Vulnerability in bisheng by DataElement
CVE-2026-51860

7.5HIGH

Key Information:

Vendor

DataElement

Status
bisheng
Vendor
CVE Published:
30 September 2026

What is CVE-2026-51860?

A Directory Traversal vulnerability exists in bisheng versions 2.3.0, 2.4.0, and 2.4.0-beta1, specifically within the task_exec.py file located in src/backend/bisheng/linsight/domain. This flaw allows an attacker to manipulate file paths, potentially accessing sensitive files stored outside the intended directory, posing significant security risks to the affected systems.

References

https://github.com/dataelement/bisheng/issues/1994
https://gist.github.com/Ro1ME/e4129afdd9af2ff1bdcecf27ec5...

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.