CVE-2026-90691
0x4m4 HexStrike AI API Files Endpoint hexstrike_server.py FileOperationsManager path traversal
CVSS Score
8.3
EPSS Score
0.0%
EPSS Percentile
0th
A security vulnerability has been detected in 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04. The impacted element is the function FileOperationsManager of the file hexstrike_server.py of the component API Files Endpoint. The manipulation of the argument filename leads to path traversal. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
| CWE | CWE-22 |
| Vendor | 0x4m4 |
| Product | hexstrike ai |
| Published | Sep 14, 2026 |
| Last Updated | Sep 14, 2026 |
Stay Ahead of the Next One
Get instant alerts for 0x4m4 hexstrike ai
Be the first to know when new high vulnerabilities affecting 0x4m4 hexstrike ai are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L/E:P/RL:X/RC:R Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
0x4m4 / HexStrike AI
d689933ff579d839c676c82b231f8e98326c5f04
References
vuldb.com: https://vuldb.com/vuln/403224 vuldb.com: https://vuldb.com/vuln/403224/cti vuldb.com: https://vuldb.com/cve/CVE-2026-90691 vuldb.com: https://vuldb.com/submit/914893 github.com: https://github.com/0x4m4/hexstrike-ai/issues/225 github.com: https://github.com/0x4m4/hexstrike-ai/pull/159 github.com: https://github.com/0x4m4/hexstrike-ai/issues/135
Credits
🔍 ez-lbz (VulDB User) VulDB CNA Team