CVE-2026-105032: Unrestricted Upload of File with Dangerous Type

The EnergizeLab Eilik and EilikO AI skill upload endpoint, served by the FastAPI AI inference and profiling services, does not require authentication and does not constrain uploaded file paths. An unauthenticated remote attacker can use path traversal to write arbitrary files, and thereby tamper...

PT-2026-115225

Name of the Vulnerable Software and Affected Versions EnergizeLab Eilik and EilikO affected versions not specified Description The FastAPI AI inference and profiling services lack authentication for AI model administration functions. This allows an unauthenticated remote attacker to modify the AI...

EnergizeLab FastAPI AI inference server has a path traversal vulnerability

The EnergizeLab FastAPI AI inference server has a security vulnerability. This vulnerability stems from the AI skills upload endpoint not requiring authentication and not restricting the path of the uploaded files. This allows unauthorized remote attackers to exploit path traversal to write...

EnergizeLab FastAPI AI inference server authorization issue vulnerability

The EnergizeLab FastAPI AI inference server has a vulnerability related to authorization. This vulnerability arises from the lack of authentication for the AI model management function, which may allow unauthenticated remote attackers to modify the AI model configuration and switch the model that...