CVE-2026-116046

eventcatalog sdk Custom Documentation Helpers custom-docs.ts rmCustomDoc path traversal

State: Published
Severity: 4.8 Medium
Published: Oct 25, 2026
Updated: Oct 26, 2026
Reserved: Oct 24, 2026

Description

A flaw has been found in eventcatalog sdk up to 2.29.0. This vulnerability affects the function getCustomDoc/writeCustomDoc/rmCustomDoc of the file packages/sdk/src/custom-docs.ts of the component Custom Documentation Helpers. This manipulation of the argument options.path causes path traversal. It is possible to launch the attack on the local host. Upgrading to version 2.30.0 is able to resolve this issue. Patch name: a4f072a03f440d58230092e88d8b4893f4c6d6ca. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Scores

CVSS	Score	Vector	Source
4.0	4.8 Medium	CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X	VulDB
3.1	5.3 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C	VulDB
3.0	5.3 Medium	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C	VulDB
2.0	4.3 Medium	AV:L/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:OF/RC:C	VulDB

Weaknesses

CWE-22 Path Traversal

Affected Products

Product	Versions
sdkeventcatalog	2.0Affected 2.1Affected 2.2Affected 2.3Affected 2.4Affected 2.5Affected 2.6Affected 2.7Affected 2.8Affected 2.9Affected 2.10Affected 2.11Affected 2.12Affected 2.13Affected 2.14Affected 2.15Affected 2.16Affected 2.17Affected 2.18Affected 2.19Affected 2.20Affected 2.21Affected 2.22Affected 2.23Affected 2.24Affected and 6 more versions

References

VDB-426122 | eventcatalog sdk Custom Documentation Helpers custom-docs.ts rmCustomDoc path traversalvdb-entrytechnical-description
VDB-426122 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
CVE-2026-116046 | CVE Analysis and Reportthird-party-advisory
Submit #994176 | EventCatalog @eventcatalog/sdk 2.29.0 Path Traversalthird-party-advisory
https://github.com/event-catalog/eventcatalog/pull/2936issue-trackingpatch
https://github.com/event-catalog/eventcatalog/commit/a4f072a03f440d58230092e88d8b4893f4c6d6capatch
https://github.com/event-catalog/eventcatalog/releases/tag/%40eventcatalog%2Fsdk%402.30.0patch

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.