CVE-2026-105032

critical · 9.1

The EnergizeLab Eilik and EilikO AI skill upload endpoint, served by the FastAPI AI inference and profiling services, does not require authentication and does not constrain uploaded file paths. An unauthenticated remote attacker can use path traversal to write arbitrary files, and thereby tamper with AI skill files used by Eilik and EilikO robots.

9.1

CVSS

0.9%

EPSS (exploit prob.)

59th

EPSS percentile

2026-10-15

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Weaknesses

CWE-22CWE-434

References

https://github.com/xn0tsa/your-secrets-are-safe-with-me
https://takeonme.org/gcves/GCVE-1337-2026-00000000000000000000000000000000000000000000000001011111111110011111111110000000000000000000000000000000000000000000000000000001100/
https://www.theverge.com/tech/1010727/eiliko-robot-hack-energize-lab

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-105032