CVE-2026-51861

bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to Code Injection in src/backend/bisheng/api/v1/validate.py...

CVE-2026-51860

bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to Directory Traversal in src/backend/bisheng/linsight/domain/taskexec.py...

CVE-2026-51859

bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to directory traversal in savedownloadfile src/backend/bisheng/core/cache/utils.py:290...

CVE-2026-51861

The software bisheng versions 2.3.0 , 2.4.0 , and 2.4.0-beta1 are vulnerable to Code Injection (CWE-94). The flaw is located within the src/backend/bisheng/api/v1/validate.py component. This vulnerability allows for unauthorized code execution, which can lead to high impact on confidentiality , i...

EUVD-2026-90421

bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to directory traversal in savedownloadfile src/backend/bisheng/core/cache/utils.py:290...

CVE-2026-51861

bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to Code Injection in src/backend/bisheng/api/v1/validate.py...

CVE-2026-51860: Improper Limitation of a Pathname to a Restricted Directory

bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to Directory Traversal in src/backend/bisheng/linsight/domain/taskexec.py...

CVE-2026-51859

bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to directory traversal in savedownloadfile src/backend/bisheng/core/cache/utils.py:290...

CVE-2026-51860

bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to Directory Traversal in src/backend/bisheng/linsight/domain/taskexec.py...

CVE-2026-51860

The bisheng software versions 2.3.0 , 2.4.0 , and 2.4.0-beta1 are vulnerable to a Directory Traversal flaw. The vulnerability exists within the src/backend/bisheng/linsight/domain/task_exec.py component. This issue allows for unauthorized access to files or directories outside of the intended sco...

EUVD-2026-90419

bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to Code Injection in src/backend/bisheng/api/v1/validate.py...

EUVD-2026-90420

bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to Directory Traversal in src/backend/bisheng/linsight/domain/taskexec.py...

PT-2026-103611

Name of the Vulnerable Software and Affected Versions bisheng versions 2.3.0 through 2.4.0 Description A directory traversal issue exists in the file src/backend/bisheng/linsight/domain/task exec.py. Directory traversal is a flaw that allows an attacker to access files and directories that are...

PT-2026-103610

Name of the Vulnerable Software and Affected Versions bisheng versions 2.3.0 through 2.4.0 Description A directory traversal issue exists in the save download file function located in src/backend/bisheng/core/cache/utils.py:290. Directory traversal is a flaw that allows an attacker to access file...

CVE-2026-51860

bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to Directory Traversal in src/backend/bisheng/linsight/domain/taskexec.py...

CVE-2026-51861: Undefined Security Weakness

bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to Code Injection in src/backend/bisheng/api/v1/validate.py...

CVE-2026-51859

The bisheng software (versions 2.3.0 , 2.4.0 , and 2.4.0-beta1 ) is vulnerable to a directory traversal flaw in the save_download_file function (located at src/backend/bisheng/core/cache/utils.py:290). This vulnerability allows an attacker to access files and directories outside the web root fold...

CVE-2026-51859: Improper Limitation of a Pathname to a Restricted Directory

bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to directory traversal in savedownloadfile src/backend/bisheng/core/cache/utils.py:290...

CVE-2026-82285

bisheng through 2.6.0-fix2 contains a server-side request forgery vulnerability in the POST /api/v1/workflow/report/callback endpoint that lacks authentication and applies no URL scheme restrictions or host filtering. Unauthenticated attackers can supply arbitrary URLs to enumerate internal netwo...

CVE-2026-82278

BISHENG before 2.6.0 contains a remote code execution vulnerability in the workflow runonce endpoint that allows authenticated users to execute arbitrary Python code. Attackers can submit crafted Code node definitions to the POST /api/v1/workflow/runonce endpoint, which executes them with exec...