CVE-2026-105032

EnergizeLab Eilik AI Skill Upload Unauthenticated Path Traversal Arbitrary File Write

State: Published
Severity: 9.1 Critical
Published: Oct 15, 2026
Updated: Oct 16, 2026
Reserved: Oct 2, 2026

Description

The EnergizeLab Eilik and EilikO AI skill upload endpoint, served by the FastAPI AI inference and profiling services, does not require authentication and does not constrain uploaded file paths. An unauthenticated remote attacker can use path traversal to write arbitrary files, and thereby tamper with AI skill files used by Eilik and EilikO robots.

Scores

CVSS	Score	Vector	Source
3.1	9.1 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H	AHA

Weaknesses

CWE-434 Unrestricted Upload of File with Dangerous Type
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected Products

Product	Versions
FastAPI AI inference serverEnergizeLab	n/aAffected

References

https://github.com/xn0tsa/your-secrets-are-safe-with-metechnical-description
https://takeonme.org/gcves/GCVE-1337-2026-00000000000000000000000000000000000000000000000001011111111110011111111110000000000000000000000000000000000000000000000000000001100/third-party-advisory
https://www.theverge.com/tech/1010727/eiliko-robot-hack-energize-labmedia-coverage

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.