What’s Vulnerable › Vulnerabilities

CVE-2026-114379: EKKOLearnAI ekko-studio Media Generation API media.ts saveGeneratedImages file inclusion

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-21 · updated 2026-10-28
• Weakness: CWE-73

Description

A flaw has been found in EKKOLearnAI ekko-studio up to 1.0.6. This vulnerability affects the function saveGeneratedImages of the file packages/server/src/modules/studio/controllers/media.ts of the component Media Generation API. This manipulation of the argument output_path causes file inclusion. Remote exploitation of the attack is possible. Patch name: 1d42459c292f89e412f7f6243829e7fed2e85bf5. It is recommended to apply a patch to fix this issue.

Affected products

• EKKOLearnAI ekko-studio: 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5 (+1)

References

• https://github.com/EKKOLearnAI/ekko-studio/
• https://github.com/EKKOLearnAI/ekko-studio/commit/1d42459c292f89e412f7f6243829e7fed2e85bf5
• https://github.com/EKKOLearnAI/ekko-studio/issues/3319
• https://github.com/EKKOLearnAI/ekko-studio/pull/3404
• https://vuldb.com/cve/CVE-2026-114379
• https://vuldb.com/submit/1019724
• https://vuldb.com/vuln/424736
• https://vuldb.com/vuln/424736/cti

Get alerted when CVE-2026-114379 or the next vulnerability affects your stack