Unauthenticated Path Traversal in SGLangs Multimodal Generation Runtime

CVE-2026-7302

What is CVE-2026-7302?

The SGLangs multimodal generation runtime has a vulnerability that enables unauthenticated users to perform a path traversal attack. This flaw allows an attacker to manipulate file upload paths using '../' sequences, granting them the ability to write arbitrary files in server directories where the process has write permissions. The vulnerability can be exploited when specific endpoints are targeted, posing significant risks to the integrity of the server and the data it handles.

References