Path Traversal Vulnerability in TaskingAI QR Code Generator Plugin by TaskingAI
CVE-2026-51907

8.1HIGH

Key Information:

Vendor

TaskingAI

Status
QR Code Generator
Vendor
CVE Published:
2 October 2026

What is CVE-2026-51907?

A path traversal vulnerability in version 0.3.0 of TaskingAI's QR Code Generator plugin exists within the save_base64_image function. This flaw allows attackers to exploit the project_id parameter to manipulate file write locations on the server filesystem, potentially leading to unauthorized access and file manipulation. Proper input validation and sanitization measures are crucial to mitigate this security risk.

References

https://github.com/TaskingAI/TaskingAI/issues/374
https://gist.github.com/Ro1ME/357950ddd2f65566b1b33525651...

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.