by Kastro
Paper/Archive/CVE-2026-105032

CVE-2026-105032

EnergizeLab FastAPI AI inference server — EnergizeLab Eilik AI Skill Upload Unauthenticated Path Traversal Arbitrary File Write

EPSS 0.9%CVSS 9.1
critical.is priorityof 100
39
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 59.7.597 × 2011.9No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The EnergizeLab Eilik and EilikO AI skill upload endpoint, served by the FastAPI AI inference and profiling services, does not require authentication and does not constrain uploaded file paths. An unauthenticated remote attacker can use path traversal to write arbitrary files, and thereby tamper with AI skill files used by Eilik and EilikO robots.

Affected

ProductAffectedFixed inSource
FastAPI AI inference servern/a–CNA

Scores by source

AHA (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

writeupgithub.com/xn0tsa/your-secrets-are-safe-with-mewriteuptakeonme.org/gcves/GCVE-1337-2026-00000000000000000000000000000000000000000000000001011111111110011111111110000000000000000000000000000000000000000000000000000001100reftheverge.com/tech/1010727/eiliko-robot-hack-energize-lab