CVE-2026-7302: Sglang: güvenlik açığı

Açıklama (NVD)

SGLangs multimodal generation runtime is vulnerable to an unauthenticated path traversal vulnerability, allowing an attacker to write arbitrary files anywhere the server process has write access, by including ../ sequences in the upload filename when sent to specific endpoints.

Özet bilgiler

Ürün

Lmsys Sglang

CVSS v3.1

9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

EPSS

%0,39 (yüzdelik 33)

CWE

CWE-35

Yama

Yok / bilinmiyor

Etkilenen sürümler

Kaynaklar

• NVD kaydı
• antiproof.ai
• github.com
• CWE-35