Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-51880: Deeptutor 1.4.0 can let remote users modify any file
CVE-2026-51880 · published 17 days ago
Summary
The Deeptutor version 1.4.0 software lets someone connected to its live tutorbot web interface write or change files outside the intended work area. This means an attacker could overwrite important system files or add malicious code. Update to a newer version or apply the vendor’s patch and restrict access to the WebSocket interface.
Original advisory text
deeptutor 1.4.0 contains a path traversal issue in EditFileTool.execute. Through the live tutorbot WebSocket interface, a remote caller can induce the tool layer to write or edit absolute paths out...
deeptutor 1.4.0 contains a path traversal issue in EditFileTool.execute. Through the live tutorbot WebSocket interface, a remote caller can induce the tool layer to write or edit absolute paths outside the intended bot workspace.
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Severity
9.8
Critical
Type
CWE-22Path Traversal
Timeline
Published1 Oct 2026
Updated15 Oct 2026
First seen1 Oct 2026
Track software like this
Free during beta