Medium 5.3Published Oct 25, 2026

CVE-2026-116046eventcatalog sdk Custom Documentation Helpers custom-docs.ts rmCustomDoc path traversal

Updated under an hour ago (Oct 28, 2026, 5:00 AM ET)

Does this affect you?

It affects eventcatalog sdk. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for eventcatalog sdk

Exploited in the last 30 days

A flaw has been found in eventcatalog sdk up to 2.29.0. This vulnerability affects the function getCustomDoc/writeCustomDoc/rmCustomDoc of the file packages/sdk/src/custom-docs.ts of the component Custom Documentation Helpers. This manipulation of the argument options.path causes path traversal. It is possible to launch the attack on the local host. Upgrading to version 2.30.0 is able to resolve this issue. Patch name: a4f072a03f440d58230092e88d8b4893f4c6d6ca. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

CVSS: 5.3 MEDIUM (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C
Weakness (CWE): CWE-22
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: VulDB
NVD analysis: Deferred
Record last updated: Oct 26, 2026
First seen by InfoSec Signals: Oct 25, 2026

Affected products

Affected products

eventcatalog sdk eventcatalog:sdk	2.0; 2.1; 2.2; 2.3; 2.4; 2.5; 2.6; 2.7; and 23 more ranges	CNA record

References

References

https://vuldb.com/vuln/426122	vdb-entry, technical-description
https://vuldb.com/vuln/426122/cti	signature, permissions-required
https://vuldb.com/cve/CVE-2026-116046	third-party-advisory
https://vuldb.com/submit/994176	third-party-advisory
https://github.com/event-catalog/eventcatalog/pull/2936	issue-tracking, patch
https://github.com/event-catalog/eventcatalog/commit/a4f072a03f440d58230092e88d8b4893f4c6d6ca	patch
https://github.com/event-catalog/eventcatalog/releases/tag/%40eventcatalog%2Fsdk%402.30.0	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.