CVE-2026-5258

Medium

Published: 01 April 2026

Published

01 April 2026

Modified

24 April 2026

KEV Added

—

Patch

—

CVSS Score v4 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Score 0.0003 10.1th percentile

Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-5258 is a medium-severity Path Traversal (CWE-22) vulnerability. Its CVSS base score is 6.9 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 10.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2026-5258 is a path traversal vulnerability (CWE-22) in Sanster IOPaint version 1.5.3. The flaw affects the _get_file function in the iopaint/file_manager/file_manager.py file of the File Manager component, where manipulation of the filename argument enables path traversal.

The vulnerability is exploitable remotely by unauthenticated attackers with network access, requiring low attack complexity and no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, base score 7.3). Attackers can achieve limited impacts on confidentiality, integrity, and availability through this vector.

Advisories from VulDB and a related GitHub issue indicate that an exploit has been made public and could be used. The vendor was contacted early about the disclosure but did not respond, with no patches or mitigations mentioned in the available references.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-17821

Vulnerability details

A vulnerability was found in Sanster IOPaint 1.5.3. Impacted is the function _get_file of the file iopaint/file_manager/file_manager.py of the component File Manager. Performing a manipulation of the argument filename results in path traversal. The attack is possible to be carried…

out remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

CWE(s): CWE-22

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1005 Data from Local System Collection

Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.

attack.mitre.org →

Why these techniques?

Path traversal in public-facing web app enables remote unauthenticated exploitation (T1190) and direct access to arbitrary local files for data collection (T1005).

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1