CVE-2026-101080— Tencent AI-Infra-Guard File Access dir_actions.py startsWith path traversal
Quick assessment
Affected
Tencent AI-Infra-Guard
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在腾讯 AI-Infra-Guard 4.5.2 及 4.6.2 之前版本中发现了一个漏洞。该漏洞影响 File Access 组件中 skill_scan/tools/dir/dir_actions.py 文件的 startsWith 函数。此漏洞可导致路径遍历。攻击必须在本机执行。利用代码已公开，可能被攻击者使用。升级至 4.6.0 版本可缓解此问题。补丁标识为 ac0384edc9dbea3b226edefcf50613bd8509134f。建议尽快升级受影响的组件。
Possible ATT&CK Techniques 1 AI
T1564.004 · NTFS File Attributes
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-101080
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Tencent AI-Infra-Guard File Access dir_actions.py startsWith path traversal
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability was identified in Tencent AI-Infra-Guard up to 4.5.2/4.6.2. This affects the function startsWith of the file skill_scan/tools/dir/dir_actions.py of the component File Access. The manipulation leads to path traversal. The attack needs to be performed locally. The exploit is publicly available and might be used. Upgrading to version 4.6.0 is able to mitigate this issue. The identifier of the patch is ac0384edc9dbea3b226edefcf50613bd8509134f. You should upgrade the affected component.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Tencent | AI-Infra-Guard | 4.5.0 |
cpe:2.3:a:tencent:ai-infra-guard:*:*:*:*:*:*:*:*
|
|
II. Public POCs for CVE-2026-101080
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-101080
请登录查看更多情报信息。
Other References for CVE-2026-101080 (8)
-
-
-
https://vuldb.com/cve/CVE-2026-101080 third-party-advisory
-
-
https://vuldb.com/submit/931298 third-party-advisory
IV. Related Vulnerabilities
Same vendor: Tencent
-
CVE-2026-94111
Tencent BrowserSkill through 0.3.0 Origin Validation Error i -
CVE-2026-89040
Tencent Mass Service Engine in Cluster (MSEC) path traversal -
CVE-2026-91750
WeKnora before 0.7.0 SSRF via Unvalidated HTTP Redirects -
CVE-2026-84809
Tencent AI-Infra-Guard skill-scan Analysis Bypass via Exclud -
CVE-2026-72565
Tencent APIJSON - Unauthenticated SQL Injection via @having
Same weakness: CWE-22
-
CVE-2026-101082
PMWeb downloader.aspx path traversal -
CVE-2026-90925
Path Traversal in Innotim Software's Logsign SIEM -
CVE-2026-85185
Path traversal in LXD btrfs storage driver allows arbitrary -
CVE-2026-85526
Path traversal via Btrfs optimized-backup subvolumes[].path -
CVE-2026-86334
CLI Path Traversal via Content-Disposition in LXD Image Expo
V. Comments for CVE-2026-101080
No comments yet