CVE-2026-5258
Published: 01 April 2026
Summary
CVE-2026-5258 is a high-severity Path Traversal (CWE-22) vulnerability. Its CVSS base score is 7.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 31.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates path traversal in the _get_file function by requiring validation of the filename argument to block traversal sequences like '../'.
Enforces access controls on file paths resolved from the filename parameter, preventing unauthorized access to files outside the intended directory.
Boundary protection at network interfaces can inspect and block remote requests containing path traversal payloads in the filename argument.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Path traversal in public-facing web app enables remote unauthenticated exploitation (T1190) and direct access to arbitrary local files for data collection (T1005).
NVD Description
A vulnerability was found in Sanster IOPaint 1.5.3. Impacted is the function _get_file of the file iopaint/file_manager/file_manager.py of the component File Manager. Performing a manipulation of the argument filename results in path traversal. The attack is possible to be carried…
more
out remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Deeper analysisAI
CVE-2026-5258 is a path traversal vulnerability (CWE-22) in Sanster IOPaint version 1.5.3. The flaw affects the _get_file function in the iopaint/file_manager/file_manager.py file of the File Manager component, where manipulation of the filename argument enables path traversal.
The vulnerability is exploitable remotely by unauthenticated attackers with network access, requiring low attack complexity and no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, base score 7.3). Attackers can achieve limited impacts on confidentiality, integrity, and availability through this vector.
Advisories from VulDB and a related GitHub issue indicate that an exploit has been made public and could be used. The vendor was contacted early about the disclosure but did not respond, with no patches or mitigations mentioned in the available references.
Details
- CWE(s)