CVE-2026-30351
Published: 27 April 2026
Summary
CVE-2026-30351 is a high-severity Path Traversal (CWE-22) vulnerability. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 5.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-30351, published on 2026-04-27, is a path traversal vulnerability (CWE-22) in the UI/static component of the leonvanzyl/autocoder project at commit 79d02a. It enables attackers to read arbitrary files on the affected system by sending crafted URL paths containing traversal sequences. The vulnerability carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating high confidentiality impact with network accessibility and low attack complexity.
Any unauthenticated attacker with network access to the affected instance can exploit this vulnerability without requiring user interaction. By crafting and sending a malicious URL to the UI/static endpoint, they can traverse directories and access arbitrary files, potentially exposing sensitive configuration data, source code, or other server-side information.
Mitigation details and advisories are available in the referenced sources, including the GitHub repository at https://github.com/leonvanzyl/autocoder and the Gist at https://gist.github.com/syphonetic/0201da0fda7f700e0701d82d755d78a0. Security practitioners should review these for patch information or workarounds specific to the affected commit.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-25862
Vulnerability details
A path traversal vulnerability in the UI/static component of leonvanzyl autocoder commit 79d02a allows attackers to read arbitrary files via sending crafted URL path containing traversal sequences.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Path traversal in public-facing UI/static endpoint enables unauthenticated remote file reads (T1190 for initial access via public app exploitation; T1005 for direct collection of arbitrary local system files like configs/source).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 requires validation of URL path inputs to reject traversal sequences like '../', directly preventing attackers from accessing arbitrary files via crafted requests.
SI-2 mandates identification, prioritization, and correction of the specific path traversal flaw in the UI/static component at commit 79d02a, eliminating the vulnerability.
SC-7 implements boundary protection such as web application firewalls to inspect and block network traffic with malicious traversal paths targeting the UI/static endpoint.