Read the docs
TI-2026-80130 Aliases CVE-2026-116046GHSA-wcv6-jfg6-vfc5

Path traversal in EventCatalog SDK custom documentation helpers

Priority LOW 21CWE-22Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

EventCatalog SDK versions from 2.0 before 2.30.0 are affected. The custom documentation helpers do not restrict the options.path argument to the intended directory, which enables path traversal (CWE-22). A local attacker with low privileges can use this to reach files outside the intended directory, affecting confidentiality, integrity and availability.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

A flaw has been found in eventcatalog sdk up to 2.29.0. This vulnerability affects the function getCustomDoc/writeCustomDoc/rmCustomDoc of the file packages/sdk/src/custom-docs.ts of the component Custom Documentation Helpers. This manipulation of the argument options.path causes path traversal. It is possible to launch the attack on the local host. Upgrading to version 2.30.0 is able to resolve this issue. Patch name: a4f072a03f440d58230092e88d8b4893f4c6d6ca. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00138 3rd percentileScored 2026-11-07
Fix Fixed sdk (eventcatalog): 2.30.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
eventcatalogsdk2.0; 2.1; 2.2; 2.3; 2.4; 2.5; 2.6; 2.7; 2.8; 2.9; 2.10; 2.11; 2.12; 2.13; 2.14; 2.15; 2.16; 2.17; 2.18; 2.19; 2.20; 2.21; 2.22; 2.23; 2.24; 2.25; 2.26; 2.27; 2.28; 2.29.02.30.0Patch availableCNA
  • sdk Vendoreventcatalog Affected 2.0; 2.1; 2.2; 2.3; 2.4; 2.5; 2.6; 2.7; 2.8; 2.9; 2.10; 2.11; 2.12; 2.13; 2.14; 2.15; 2.16; 2.17; 2.18; 2.19; 2.20; 2.21; 2.22; 2.23; 2.24; 2.25; 2.26; 2.27; 2.28; 2.29.0 Fixed in 2.30.0 Patch available CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:eventcatalog:sdk:*:*:*:*:*:*:*:*——eventcatalog
  • cpe:2.3:a:eventcatalog:sdk:*:*:*:*:*:*:*:* Versions — — ·eventcatalog

Remediation

Upgrade EventCatalog SDK to version 2.30.0, which fixes the flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA sdk (eventcatalog) Fixed in 2.30.0

Timeline

  1. 2026-10-25 Threatist record created from CVE-2026-116046
  2. 2026-10-26 CISA SSVC decision points changed
  3. 2026-10-27 Alias added: GHSA-wcv6-jfg6-vfc5

References

Patch 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences