CVE-2026-73079: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Wei-Shaw sub2api
Sub2API is an AI API gateway platform designed to distribute and manage API quotas from AI product subscriptions. From 0.1.135, to 0.1.168, platform API keys issued to tenants are exchanged for upstream requests made with shared provider accounts (ChatGPT/Codex OAuth, OpenAI platform keys, or an operator-configured base URL) that belong to the operator, not to the caller. The `POST /responses/*subpath` wildcard routes spliced the client-supplied subpath into the upstream URL with no validation. This lets an authenticated tenant relay requests to arbitrary upstream endpoints using pooled account credentials via a path traversal. This vulnerability is fixed in 0.1.169.
AI Analysis
Technical Summary
Wei-Shaw sub2api, an AI API gateway platform, has a path traversal vulnerability (CWE-22) in versions before 0.1.169. The platform exchanges tenant API keys for upstream requests made with shared operator credentials. The POST /responses/*subpath wildcard route concatenates the client-supplied subpath directly into the upstream URL without validation, enabling authenticated tenants to access arbitrary upstream endpoints via path traversal. This can lead to unauthorized use of pooled account credentials. The vulnerability is addressed in version 0.1.169.
Potential Impact
An authenticated tenant can exploit this vulnerability to relay requests to arbitrary upstream endpoints using the operator's shared provider credentials. This may lead to unauthorized access to upstream services and potential data exposure or misuse of the operator's credentials. The CVSS score of 8.5 indicates high severity with high confidentiality impact, limited integrity impact, and no availability impact.
Mitigation Recommendations
Upgrade Wei-Shaw sub2api to version 0.1.169 or later, where this path traversal vulnerability is fixed. No other mitigation is indicated or required according to the available data.
CVE-2026-73079: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Wei-Shaw sub2api
Description
Sub2API is an AI API gateway platform designed to distribute and manage API quotas from AI product subscriptions. From 0.1.135, to 0.1.168, platform API keys issued to tenants are exchanged for upstream requests made with shared provider accounts (ChatGPT/Codex OAuth, OpenAI platform keys, or an operator-configured base URL) that belong to the operator, not to the caller. The `POST /responses/*subpath` wildcard routes spliced the client-supplied subpath into the upstream URL with no validation. This lets an authenticated tenant relay requests to arbitrary upstream endpoints using pooled account credentials via a path traversal. This vulnerability is fixed in 0.1.169.
CVSS v3.1
Score 8.5high
Affected software
Wei-Shaw
sub2api
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Wei-Shaw sub2api, an AI API gateway platform, has a path traversal vulnerability (CWE-22) in versions before 0.1.169. The platform exchanges tenant API keys for upstream requests made with shared operator credentials. The POST /responses/*subpath wildcard route concatenates the client-supplied subpath directly into the upstream URL without validation, enabling authenticated tenants to access arbitrary upstream endpoints via path traversal. This can lead to unauthorized use of pooled account credentials. The vulnerability is addressed in version 0.1.169.
Potential Impact
An authenticated tenant can exploit this vulnerability to relay requests to arbitrary upstream endpoints using the operator's shared provider credentials. This may lead to unauthorized access to upstream services and potential data exposure or misuse of the operator's credentials. The CVSS score of 8.5 indicates high severity with high confidentiality impact, limited integrity impact, and no availability impact.
Mitigation Recommendations
Upgrade Wei-Shaw sub2api to version 0.1.169 or later, where this path traversal vulnerability is fixed. No other mitigation is indicated or required according to the available data.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-08-10T19:37:41.444Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a7b49e9bf8831d53902c40c
Added to database: 08/11/2026, 16:12:25 UTC
Last enriched: 08/11/2026, 16:26:09 UTC
Last updated: 09/25/2026, 14:34:30 UTC
Views: 96
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.