CVE-2026-105032: CWE-434 Unrestricted Upload of File with Dangerous Type in EnergizeLab FastAPI AI inference server
Description
CVE-2026-105032 is a critical vulnerability in the EnergizeLab FastAPI AI inference server used by Eilik and EilikO robots. The AI skill upload endpoint lacks authentication and does not restrict file paths, allowing unauthenticated remote attackers to perform path traversal and write arbitrary files. This can lead to tampering with AI skill files, potentially disrupting robot behavior or causing denial of service.
CVSS v3.1
Score 9.1critical
Affected software
EnergizeLab
FastAPI AI inference server
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The EnergizeLab Eilik and EilikO AI skill upload endpoint, served by the FastAPI AI inference and profiling services, is vulnerable to unrestricted file upload with dangerous types (CWE-434). The endpoint does not require authentication and does not constrain uploaded file paths, enabling unauthenticated remote attackers to exploit path traversal to write arbitrary files. This vulnerability allows attackers to tamper with AI skill files used by the robots, impacting their operation.
Potential Impact
An unauthenticated remote attacker can write arbitrary files to the server by exploiting path traversal in the upload endpoint. This can lead to tampering with AI skill files, resulting in integrity violations and potentially causing denial of service or manipulation of robot behavior. The CVSS v3.1 score is 9.1 (critical), reflecting high impact on integrity and availability without requiring privileges or user interaction.
Mitigation Recommendations
No patch or official fix information is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict network access to the upload endpoint and monitor for unauthorized file changes if possible.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- AHA
- Date Reserved
- 2026-10-02T21:30:55.241Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ad13fda2cdf04f6565c5627
Added to database: 10/15/2026, 21:04:26 UTC
Last enriched: 10/15/2026, 21:18:38 UTC
Last updated: 10/15/2026, 21:18:38 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.