Log in Start free

Vulnerability · Published Oct 21, 2026 · Assigned by VulDB

CVE-2026-114379EKKOLearnAI ekko-studio Media Generation API media.ts saveGeneratedImages file inclusion

Medium 5.4

In plain English

A medium-severity security flaw in ekko-studio from EKKOLearnAI. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium
Exploit odds (30 days)0.3%top 80.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A flaw has been found in EKKOLearnAI ekko-studio up to 1.0.6. This vulnerability affects the function saveGeneratedImages of the file packages/server/src/modules/studio/controllers/media.ts of the component Media Generation API. This manipulation of the argument output_path causes file inclusion. Remote exploitation of the attack is possible. Patch name: 1d42459c292f89e412f7f6243829e7fed2e85bf5. It is recommended to apply a patch to fix this issue.

Affected products (as reported)

VendorProductVersions
EKKOLearnAI ekko-studio 1.0.01.0.11.0.21.0.31.0.41.0.51.0.6

Weakness: CWE-73 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:X/RL:O/RC:C

References