CVE-2026-110212 in ai-fusion-video
Summary
by MITRE • 10/13/2026
Stonewuu ai-fusion-video through 1.2.0 contains a path traversal vulnerability that allows authenticated users to write uploaded files outside the media directory via the subDir parameter of POST /api/storage/upload. Attackers can supply parent-directory sequences that LocalStorageStrategy.storeBytes never normalizes, creating directories and writing attacker-controlled files with chosen extensions anywhere the service account can write.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.