CVE-2026-116046

MEDIUM 5.3

eventcatalog sdk Custom Documentation Helpers custom-docs.ts rmCustomDoc path traversal

CVSS Score

5.3

EPSS Score

0.0%

EPSS Percentile

0th

A flaw has been found in eventcatalog sdk up to 2.29.0. This vulnerability affects the function getCustomDoc/writeCustomDoc/rmCustomDoc of the file packages/sdk/src/custom-docs.ts of the component Custom Documentation Helpers. This manipulation of the argument options.path causes path traversal. It is possible to launch the attack on the local host. Upgrading to version 2.30.0 is able to resolve this issue. Patch name: a4f072a03f440d58230092e88d8b4893f4c6d6ca. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

CWE	CWE-22
Vendor	eventcatalog
Product	sdk
Published	Oct 25, 2026

Stay Ahead of the Next One

Get instant alerts for eventcatalog sdk

Be the first to know when new medium vulnerabilities affecting eventcatalog sdk are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

eventcatalog / sdk

2.0 2.1 2.2 2.3 2.4 2.5 2.6 2.7 2.8 2.9 2.10 2.11 2.12 2.13 2.14 2.15 2.16 2.17 2.18 2.19 2.20 2.21 2.22 2.23 2.24 2.25 2.26 2.27 2.28 2.29.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/426122 vuldb.com: https://vuldb.com/vuln/426122/cti vuldb.com: https://vuldb.com/cve/CVE-2026-116046 vuldb.com: https://vuldb.com/submit/994176 github.com: https://github.com/event-catalog/eventcatalog/pull/2936 github.com: https://github.com/event-catalog/eventcatalog/commit/a4f072a03f440d58230092e88d8b4893f4c6d6ca github.com: https://github.com/event-catalog/eventcatalog/releases/tag/%40eventcatalog%2Fsdk%402.30.0

Credits

🔍 pure (VulDB User) VulDB CNA Team