Description
A flaw has been found in eventcatalog sdk up to 2.29.0. This vulnerability affects the function getCustomDoc/writeCustomDoc/rmCustomDoc of the file packages/sdk/src/custom-docs.ts of the component Custom Documentation Helpers. This manipulation of the argument options.path causes path traversal. It is possible to launch the attack on the local host. Upgrading to version 2.30.0 is able to resolve this issue. Patch name: a4f072a03f440d58230092e88d8b4893f4c6d6ca. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Published: 2026-10-25
Score: 4.8 Medium
EPSS: < 1% Very Low
KEV: No
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No solution or workaround provided in the CVE record.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 25 Oct 2026 07:15:00 +0000

Type Values Removed Values Added
Description A flaw has been found in eventcatalog sdk up to 2.29.0. This vulnerability affects the function getCustomDoc/writeCustomDoc/rmCustomDoc of the file packages/sdk/src/custom-docs.ts of the component Custom Documentation Helpers. This manipulation of the argument options.path causes path traversal. It is possible to launch the attack on the local host. Upgrading to version 2.30.0 is able to resolve this issue. Patch name: a4f072a03f440d58230092e88d8b4893f4c6d6ca. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Title eventcatalog sdk Custom Documentation Helpers custom-docs.ts rmCustomDoc path traversal
First Time appeared Eventcatalog
Eventcatalog sdk
Weaknesses CWE-22
CPEs cpe:2.3:a:eventcatalog:sdk:*:*:*:*:*:*:*:*
Vendors & Products Eventcatalog
Eventcatalog sdk
References
Metrics cvssV2_0

{'score': 4.3, 'vector': 'AV:L/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:OF/RC:C'}

cvssV3_0

{'score': 5.3, 'vector': 'CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C'}

cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C'}

cvssV4_0

{'score': 4.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X'}

Subscriptions

Eventcatalog Sdk
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-25T06:45:08.260Z

Reserved: 2026-10-24T13:57:18.443Z

Link: CVE-2026-116046

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-25T07:16:47.180

Modified: 2026-10-25T07:16:47.180

Link: CVE-2026-116046

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-25T09:30:10Z

Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')