Path Traversal Vulnerability in 0x4m4 HexStrike AI's API Files Endpoint
CVE-2026-90691

6.9MEDIUM

Key Information:

Vendor: 0x4m4
Status: Hexstrike Ai
Vendor: CVE Published:; 14 September 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-90691?

A security issue has been identified in the 0x4m4 HexStrike AI application, specifically involving the FileOperationsManager function located in hexstrike_server.py. This vulnerability allows for path traversal attacks by manipulating the filename argument, potentially enabling unauthorized access to sensitive files on the server. The issue has been publicly disclosed, and there is concern regarding its exploitation as it may be initiated remotely. Despite being reported to the project maintainers, there has been no response or patch provided to mitigate this security risk.

Affected Version(s)

HexStrike AI d689933ff579d839c676c82b231f8e98326c5f04

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-90691 - Proof of Concept