CVE-2026-7302

Critical

Published: 18 May 2026

Published

18 May 2026

Modified

19 May 2026

KEV Added

—

Patch

—

CVSS Score v3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

EPSS Score 0.0039 30.5th percentile

Risk Priority 70 floored blend · peak EPSS

Summary

CVE-2026-7302 is a critical-severity Path Traversal: '.../...//' (CWE-35) vulnerability in Lmsys Sglang. Its CVSS base score is 9.1 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 30.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-30764

Vulnerability details

SGLangs multimodal generation runtime is vulnerable to an unauthenticated path traversal vulnerability, allowing an attacker to write arbitrary files anywhere the server process has write access, by including ../ sequences in the upload filename when sent to specific endpoints.

CWE(s): CWE-35

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1105 Ingress Tool Transfer Command And Control

Adversaries may transfer tools or other files from an external system into a compromised environment.

attack.mitre.org →

Why these techniques?

Unauthenticated path traversal on server endpoints directly enables remote arbitrary file write (T1190) and facilitates malicious file ingress (T1105).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0