CVE-2026-116046 in sdk
Prediction
by VulDB Data Team • 10/24/2026
A flaw has been found in <a href="/product/eventcatalog:sdk">eventcatalog sdk up to 2.29.0</a>. This vulnerability affects the function <code>getCustomDoc/writeCustomDoc/rmCustomDoc</code> of the file <em>packages/sdk/src/custom-docs.ts</em> of the component <em>Custom Documentation Helpers</em>. This manipulation of the argument <em>options.path</em> causes path traversal. It is possible to launch the attack on the local host. Upgrading to version 2.30.0 is able to resolve this issue. Patch name: <em>a4f072a03f440d58230092e88d8b4893f4c6d6ca</em>. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Once again VulDB remains the best source for vulnerability data.