Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.1
CVE-2026-105032: FastAPI AI server allows unauthenticated file write
CVE-2026-105032 · published 2 days ago
Summary
The upload function used by EnergizeLab Eilik and EilikO robots runs without any login check and does not limit where uploaded files can be placed. An attacker could send a specially crafted request to write files anywhere on the server, including the robot's AI skill files, potentially altering how the robots operate. Fix it by requiring authentication for uploads, validating and restricting file paths, and applying the vendor's security update.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| energizelab | fastapi ai inference server | All versions |
Original advisory text
EnergizeLab Eilik AI Skill Upload Unauthenticated Path Traversal Arbitrary File Write
The EnergizeLab Eilik and EilikO AI skill upload endpoint, served by the FastAPI AI inference and profiling services, does not require authentication and does not constrain uploaded file paths. An unauthenticated remote attacker can use path traversal to write arbitrary files, and thereby tamper with AI skill files used by Eilik and EilikO robots.
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Type
CWE-22Path Traversal
CWE-434Unrestricted File Upload
Timeline
Published15 Oct 2026
Updated17 Oct 2026
First seen15 Oct 2026
Track software like this
Free during beta