SGLang’s multimodal generation runtime contains an unauthenticated path‑traversal flaw that lets an attacker supply a filename containing "../" sequences. The flaw allows the attacker to create or overwrite any file on the server where the process has write permission. By placing executable or configuration files in directories that the application or the operating system can execute, an attacker could gain remote code execution, compromise data integrity, and affect overall availability.

The affected vendor is SGLang; the vulnerable component is its multimodal generation runtime. Version information is not specified in the advisory, so any release that includes the upload endpoint handling described may be impacted. No more granular product or version details are available.

The vulnerability is exploitable without authentication, as the attack relies solely on submitting a crafted upload filename to a vulnerable endpoint. Based on the description, it is inferred that the endpoint is reachable over the network, typically via HTTPS or HTTP. The CVSS score of 9.1 indicates high severity, and the EPSS score is not available, but the simplicity of the path‑traversal and the ability to write arbitrary files indicate a high potential for exploitation. The vulnerability is not listed in the CISA KEV catalog.