CVE-2026-8757
adenhq hive Delete Request routes_sessions.py _read_events_tail path traversal
- State
- Published
- Severity
- 6.9 Medium
- Published
- May 17, 2026
- Updated
- May 18, 2026
- Reserved
- May 16, 2026
Description
A vulnerability was found in adenhq hive up to 0.11.0. This affects the function _read_events_tail of the file core/framework/server/routes_sessions.py of the component Delete Request Handler. Performing a manipulation results in path traversal. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 7.3 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 3.0 | 7.3 High | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 2.0 | 7.5 High | AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
- CWE-22 Path Traversal
Affected Products
| Product | Versions |
|---|---|
hiveadenhq |
|
References
- VDB-364384 | adenhq hive Delete Request routes_sessions.py _read_events_tail path traversalvdb-entrytechnical-description
- VDB-364384 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- Submit #811276 | adenhq hive latest Path Traversal (CWE-22)third-party-advisory
- https://gist.github.com/YLChen-007/ff3ff201b05d13d41f949f86e9187bd2exploit
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.