{"id":"CVE-2026-105032","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-105032","generatedAt":"2026-10-27T23:59:07.627Z","title":"An unauthenticated remote attacker can use path traversal to write arbitrary files, and thereby tamper with AI skill files used by Eilik and EilikO robots.","description":"The EnergizeLab Eilik and EilikO AI skill upload endpoint, served by the FastAPI AI inference and profiling services, does not require authentication and does not constrain uploaded file paths. An unauthenticated remote attacker can use path traversal to write arbitrary files, and thereby tamper with AI skill files used by Eilik and EilikO robots.","published":"2026-10-15T21:17:04.000Z","lastModified":"2026-10-16T20:17:18.000Z","status":"Deferred","sourceIdentifier":"cve@takeonme.org","cvss":{"version":"3.1","score":9.1,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"},"cwe":["CWE-22","CWE-434"],"affected":[],"epss":{"score":0.00902,"percentile":0.59476,"date":"2026-10-26","history":[{"date":"2026-10-16","score":0.00902,"percentile":0.58994}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (0.90%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[{"kind":"new","label":"New CVE","at":"2026-10-15T21:17:04.000Z","detail":{"score":"9.1","severity":"CRITICAL","publishedAt":"2026-10-15T21:17:03.753Z"},"summary":"New CVE, critical severity (CVSS 9.1)."}],"references":[{"url":"https://github.com/xn0tsa/your-secrets-are-safe-with-me","source":"cve@takeonme.org"},{"url":"https://takeonme.org/gcves/GCVE-1337-2026-00000000000000000000000000000000000000000000000001011111111110011111111110000000000000000000000000000000000000000000000000000001100/","source":"cve@takeonme.org"},{"url":"https://www.theverge.com/tech/1010727/eiliko-robot-hack-energize-lab","source":"cve@takeonme.org"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-105032","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}