Path Traversal Vulnerability in TaskingAI DALL-E 3 Image Generation Tool
CVE-2026-51906

9.1CRITICAL

Key Information:

Vendor

TaskingAI

Status
DALL-E 3
Vendor
CVE Published:
2 October 2026

What is CVE-2026-51906?

A path traversal vulnerability exists within the TaskingAI DALL-E 3 image generation tool’s save_url_image function. This flaw enables attackers to manipulate the project_id parameter, facilitating unauthorized write access to arbitrary locations on the server's filesystem. Exploiting this vulnerability could allow attackers to overwrite existing files or store malicious files on the server, potentially leading to further security breaches.

References

https://github.com/TaskingAI/TaskingAI/issues/375
https://gist.github.com/Ro1ME/3430171ed3a7e6c42864f45b59c...

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.