CVE-2026-51860 Details
Description
bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to Directory Traversal in src/backend/bisheng/linsight/domain/task_exec.py.
A directory traversal vulnerability has been identified in Bisheng versions 2.3.0, 2.4.0, and 2.4.0-beta1. The issue resides in the Linsight workflow task execution module, specifically within the file download functionality. This vulnerability allows for arbitrary file writes to locations accessible by the Bisheng process, potentially overwriting existing files, including application code and configuration.
Users are advised to update to Bisheng version 3.0.0, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://gist.github.com/Ro1ME/e4129afdd9af2ff1bdcecf27ec5098cf | [email protected] | ExploitTechnical Description |
| https://github.com/dataelement/bisheng/issues/1994 | [email protected] | BundleExploitIssue TrackingTechnical DescriptionVendor |
Weakness Enumeration
No weakness enumeration is available for this CVE.
Affected Products
| Product | Versions |
|---|---|
| bisheng | 2.3.0 (semver) 2.4.0 (semver) 2.4.0-beta1 (semver) |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 30, 2026 | New CVE Received | [email protected] |