CVE-2026-51906 describes a path traversal vulnerability in TaskingAI version 0.3.0, specifically in the save_url_image function used by the DALL-E 3 image generation tool. By manipulating the project_id parameter, an attacker can cause the application to write image files to arbitrary filesystem locations on the server, potentially overwriting or creating files outside the intended directory.

Successful exploitation could allow an attacker to write files to arbitrary locations on the server filesystem. This may lead to unauthorized file creation or overwriting, which could be leveraged for further attacks or disruption of service. No information is provided about remote code execution or privilege escalation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the vulnerable function and validate or sanitize the project_id parameter to prevent path traversal.