CVE-2026-81560: Path Traversal in blackms aistack

The vulnerability in blackms aistack up to versions 1.6.0 and 1.6.1 is due to insufficient validation of the req.url parameter in the Static File Handler component located in src/web/server.ts. This allows an attacker to perform path traversal attacks remotely by manipulating the URL argument, potentially accessing files outside the intended directory. The issue was reported early but remains unpatched, and public exploit code exists.

Successful exploitation of this vulnerability allows remote attackers to access arbitrary files on the server by traversing directories via crafted URL requests. This can lead to unauthorized disclosure of sensitive information. There is no indication of privilege escalation or code execution from the provided data.

No official fix or patch is currently available as the vendor has not responded. Users should monitor the vendor's communications for updates. In the meantime, consider implementing web server-level access controls or input validation to restrict URL path traversal if possible.