CVE-2026-19326 in Ai-doctor
Summary
by MITRE • 08/09/2026
A vulnerability was detected in Jevon-Zhong Ai-doctor 0.0.1. This vulnerability affects the function deleteImage of the file ai-doctor-server/src/filemanagement/filemanagement.service.ts. Performing a manipulation of the argument imagePath results in path traversal. The attack must be initiated from a local position. The project was informed of the problem early through an issue report but has not responded yet.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/09/2026
This vulnerability in Jevon-Zhong Ai-doctor 0.0.1 represents a critical path traversal flaw within the file management service component. The specific function deleteImage located in ai-doctor-server/src/filemanagement/filemanagement.service.ts fails to properly validate or sanitize user-supplied input parameters, particularly the imagePath argument. This oversight creates an exploitable condition where malicious actors can manipulate the imagePath parameter to traverse the file system beyond intended boundaries. The vulnerability operates through a classic path traversal attack vector where specially crafted input can cause the application to delete files outside of the designated operating directory.
The technical implementation flaw stems from inadequate input validation and sanitization practices within the file management service. When the deleteImage function processes the imagePath parameter, it likely performs direct file operations without proper path normalization or security checks that would prevent access to parent directories using sequences like "../". This vulnerability falls under CWE-22 Path Traversal which is categorized as a common weakness in software development where applications fail to properly validate file paths. The attack requires local execution privileges, meaning an attacker must already have access to the system to exploit this vulnerability effectively.
The operational impact of this vulnerability extends beyond simple unauthorized file deletion as it could potentially allow attackers with local access to compromise sensitive system files, configuration data, or other critical resources within the application's file structure. An attacker could leverage this weakness to delete essential application components, potentially causing system instability or complete service disruption. The vulnerability also presents risk for data integrity and confidentiality, especially if the application handles sensitive medical information or personal health records as part of its ai-doctor functionality.
Security practitioners should consider implementing several mitigation strategies to address this path traversal vulnerability. Input validation and sanitization must be strengthened through proper path normalization techniques that strip or encode dangerous characters from file paths before processing. The principle of least privilege should be enforced by ensuring the application operates with minimal required permissions and restricts access to only necessary directories. Additionally, implementing absolute path restrictions and using secure file handling libraries can prevent traversal attacks. Organizations should also consider implementing runtime monitoring and logging to detect potential exploitation attempts. This vulnerability aligns with ATT&CK technique T1059 Command and Scripting Interpreter where attackers may use local system access to execute malicious commands through vulnerable application functions, making it particularly concerning for healthcare environments that require strict data protection protocols under regulations such as HIPAA.