EUVD-2026-81054

Uber Kraken through 0.1.29 fails to validate the tag parameter in the /tags/tag endpoint, allowing unauthenticated attackers to traverse outside the configured storage root. Attackers can use percent-encoded parent-directory segments in the tag parameter to read arbitrary files accessible to the...

CVE-2026-92791: Improper Limitation of a Pathname to a Restricted Directory

Uber Kraken through 0.1.29 fails to validate the tag parameter in the /tags/tag endpoint, allowing unauthenticated attackers to traverse outside the configured storage root. Attackers can use percent-encoded parent-directory segments in the tag parameter to read arbitrary files accessible to the...