CVE-2026-110212: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Stonewuu ai-fusion-video

CVE-2026-110212 describes a path traversal vulnerability in Stonewuu ai-fusion-video through version 1.2.0. Authenticated users can exploit the subDir parameter of the POST /api/storage/upload API to bypass directory restrictions and write files outside the designated media directory. The vulnerability arises because the LocalStorageStrategy.storeBytes function does not normalize parent-directory sequences, allowing directory traversal and arbitrary file writes within the service account's writable scope.

An attacker with authentication can write files outside the intended media directory, potentially leading to unauthorized file creation or modification in arbitrary locations accessible by the service account. This could facilitate further attacks depending on the environment and permissions but does not inherently include privilege escalation or remote code execution based on the provided data.

No patch or official fix information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to authenticated users carefully and monitor usage of the upload API to detect potential abuse of the subDir parameter.