CVE-2026-101080

MEDIUM 4.8

Tencent AI-Infra-Guard File Access dir_actions.py startsWith path traversal

CVSS Score

4.8

EPSS Score

0.0%

EPSS Percentile

0th

A vulnerability was identified in Tencent AI-Infra-Guard up to 4.5.2/4.6.2. This affects the function startsWith of the file skill_scan/tools/dir/dir_actions.py of the component File Access. The manipulation leads to path traversal. The attack needs to be performed locally. The exploit is publicly available and might be used. Upgrading to version 4.6.0 is able to mitigate this issue. The identifier of the patch is ac0384edc9dbea3b226edefcf50613bd8509134f. You should upgrade the affected component.

CWE	CWE-22
Vendor	tencent
Product	ai-infra-guard
Published	Sep 28, 2026

Stay Ahead of the Next One

Get instant alerts for tencent ai-infra-guard

Be the first to know when new medium vulnerabilities affecting tencent ai-infra-guard are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

Tencent / AI-Infra-Guard

4.5.0 4.5.1 4.5.2 4.6.0 4.6.1 4.6.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/410952 vuldb.com: https://vuldb.com/vuln/410952/cti vuldb.com: https://vuldb.com/cve/CVE-2026-101080 vuldb.com: https://vuldb.com/submit/931298 github.com: https://github.com/Tencent/AI-Infra-Guard/issues/538 github.com: https://github.com/Tencent/AI-Infra-Guard/pull/539 github.com: https://github.com/Tencent/AI-Infra-Guard/commit/ac0384edc9dbea3b226edefcf50613bd8509134f github.com: https://github.com/Tencent/AI-Infra-Guard/releases/tag/v4.6.0 github.com: https://github.com/Tencent/AI-Infra-Guard/

Credits

🔍 nedlir (VulDB User)