CVE-2026-112147 in octoally
Summary
by MITRE • 10/19/2026
A vulnerability was found in ai-genius-automations octoally up to 1.0.87. The impacted element is an unknown function of the file server/src/index.ts. Performing a manipulation of the argument path results in information disclosure. The attack may be initiated remotely. The exploit has been made public and could be used. Upgrading to version 1.0.88 is sufficient to resolve this issue. The patch is named 3898085c4e701be21377ebd9e91e10b941e47168. It is recommended to upgrade the affected component.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/19/2026
The vulnerability identified in ai-genius-automations octoally, specifically within versions up to 1.0.87, represents a critical security flaw located in an unknown function of the server/src/index.ts file. This issue manifests as an information disclosure vulnerability triggered by manipulating the path argument passed to this specific function. The nature of this flaw suggests that the application fails to properly sanitize or validate user-supplied input related to file paths before processing them, allowing attackers to potentially access sensitive data stored on the server's filesystem. Such vulnerabilities are commonly categorized under CWE-200, which covers Exposure of Sensitive Information to an Unauthorized Actor, and often align with CWE-73, External Control of File Name or Path, depending on whether the issue stems from a lack of input validation or improper handling of directory traversal sequences.
The operational impact of this vulnerability is significant due to its remote exploitability. An attacker can initiate the attack remotely without requiring prior authentication in many configurations involving web servers and API endpoints that process file path arguments directly from HTTP requests. By crafting specific malicious payloads, an adversary could read arbitrary files from the server's disk, potentially exposing configuration files containing database credentials, private keys, environment variables with secrets, or other proprietary source code. The fact that a public exploit exists further exacerbates the risk, as it lowers the barrier to entry for less sophisticated threat actors who may leverage automated scanning tools to identify and compromise vulnerable instances across the internet. This scenario is consistent with ATT&CK technique T1083, File and Directory Discovery, where adversaries seek to gather information about the target environment to facilitate further lateral movement or data exfiltration.
The resolution for this vulnerability involves upgrading ai-genius-automations octoally to version 1.0.88 or later. The developers addressed the issue in patch commit 3898085c4e701be21377ebd9e91e10b941e47168, which likely implements stricter input validation and path normalization techniques to prevent directory traversal or unauthorized file access. It is strongly recommended that all organizations running affected versions immediately apply this upgrade to mitigate the risk of information disclosure. In addition to upgrading, administrators should ensure that their deployment environments follow security best practices such as principle of least privilege for application service accounts, restricting filesystem permissions so the web server process cannot read sensitive configuration directories, and implementing Web Application Firewall rules to detect and block common path traversal patterns in incoming requests until patches are fully deployed across all infrastructure.