by Kastro
Paper/Archive/CVE-2026-7302

CVE-2026-7302

SGLang SGLang — CVE-2026-7302

EPSS 0.4%CVSS 9.1
critical.is priorityof 100
34
CVSS 9.1 (ADP)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 32.7.327 × 206.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

SGLangs multimodal generation runtime is vulnerable to an unauthenticated path traversal vulnerability, allowing an attacker to write arbitrary files anywhere the server process has write access, by including ../ sequences in the upload filename when sent to specific endpoints.

Affected

ProductAffectedFixed inSource
SGLang5.10–CNA

Scores by source

CISA ADP9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

refgithub.com/sgl-project/sglang/tree/main/python/sglangrefantiproof.ai/blog/three-rces-in-sglang