Vulnerability · Published May 7, 2026 · Assigned by VulDB

CVE-2026-8115gyoridavid short-video-maker REST API rest.ts path traversal

Medium 5.3

In plain English

A medium-severity path traversal in short-video-maker from gyoridavid. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.6%top 52.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A security flaw has been discovered in gyoridavid short-video-maker up to 1.3.4. This affects an unknown part of the file src/server/routers/rest.ts of the component REST API. The manipulation of the argument req.params.tmpFile results in path traversal. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	short-video-maker	no fix listed	GHSA-935g-9rq5-q95c

Affected products (as reported)

Vendor	Product	Versions
gyoridavid	short-video-maker	1.3.01.3.11.3.21.3.31.3.4

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R

References

VDB-361903 | gyoridavid short-video-maker REST API rest.ts path traversal vdb-entry, technical-description
VDB-361903 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #808258 | gyoridavid short-video-maker 1.3.4 Path Traversal third-party-advisory
https://github.com/gyoridavid/short-video-maker/issues/73 exploit, issue-tracking
https://github.com/gyoridavid/short-video-maker/ product