CVE-2026-116046

eventcatalog sdk Custom Documentation Helpers custom-docs.ts rmCustomDoc path traversal

View on CVE.org
Published Oct 25, 2026 CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Description
A flaw has been found in eventcatalog sdk up to 2.29.0. This vulnerability affects the function getCustomDoc/writeCustomDoc/rmCustomDoc of the file packages/sdk/src/custom-docs.ts of the component Custom Documentation Helpers. This manipulation of the argument options.path causes path traversal. It is possible to launch the attack on the local host. Upgrading to version 2.30.0 is able to resolve this issue. Patch name: a4f072a03f440d58230092e88d8b4893f4c6d6ca. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Analysis

AI-generated

Technical impact

The eventcatalog SDK contains a path traversal flaw in the Custom Documentation Helpers module. An attacker who can influence the options.path argument of getCustomDoc, writeCustomDoc, or rmCustomDoc can cause the SDK to access, create, or delete files outside the intended directory. The CWE-22 weakness permits unauthorized local file manipulation, potentially exposing configuration files or altering documentation resources. Although the vulnerability is limited to local execution, an attacker on the same host could read or overwrite sensitive files.

Affected Systems

Vendors using the eventcatalog SDK in versions up to 2.29.0 are affected. The flaw resides in the packages/sdk/src/custom-docs.ts file of the SDK component. Upgrading to version 2.30.0 or later removes the vulnerability.

Risk and Exploitability

The CVSS score of 4.8 indicates moderate severity, and no EPSS score is provided, suggesting low exploitation probability. The vulnerability is not listed in CISA KEV, implying no known widespread exploitation. The likely attack vector is local, requiring the attacker to run code within the same system as the SDK. Absent a remote execution vector, the risk is limited to compromised hosts.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the updated SDK release 2.30.0 or newer.
  • If an immediate upgrade is not possible, enforce strict validation of the options.path argument in all code that calls getCustomDoc, writeCustomDoc, or rmCustomDoc, rejecting any value that contains traversal components such as '..'.
  • Monitor system logs for anomalous file access patterns and review any unintended modifications to documentation files.

Generated by OpenCVE AI on October 25, 2026 at 09:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A flaw has been found in eventcatalog sdk up to 2.29.0. This vulnerability affects the function getCustomDoc/writeCustomDoc/rmCustomDoc of the file packages/sdk/src/custom-docs.ts of the component Custom Documentation Helpers. This manipulation of the argument options.path causes path traversal. It is possible to launch the attack on the local host. Upgrading to version 2.30.0 is able to resolve this issue. Patch name: a4f072a03f440d58230092e88d8b4893f4c6d6ca. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Title eventcatalog sdk Custom Documentation Helpers custom-docs.ts rmCustomDoc path traversal
First Time appeared Eventcatalog
Eventcatalog sdk
Weaknesses CWE-22
CPEs cpe:2.3:a:eventcatalog:sdk:*:*:*:*:*:*:*:*
Vendors & Products Eventcatalog
Eventcatalog sdk
References
Metrics cvssV2_0

{'score': 4.3, 'vector': 'AV:L/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:OF/RC:C'}

cvssV3_0

{'score': 5.3, 'vector': 'CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C'}

cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C'}

cvssV4_0

{'score': 4.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X'}
Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Oct 26, 2026, 5:36 PM
Reserved
Oct 24, 2026, 1:57 PM

View source JSON

Updated
Oct 26, 2026, 3:38 PM

JSON

Status
Deferred
Published
Oct 25, 2026, 7:16 AM
Modified
Oct 26, 2026, 6:17 PM

View source JSON

No data.

Updated
Oct 26, 2026, 6:52 PM

JSON