CVE-2026-90691 Details

A path traversal vulnerability has been identified in 0x4m4 HexStrike AI versions up to d689933ff579d839c676c82b231f8e98326c5f04. The issue resides in the FileOperationsManager class within the hexstrike_server.py file, specifically at the API Files Endpoint. The vulnerability allows remote attackers to manipulate the filename argument, escaping the intended file sandbox and writing arbitrary files to locations outside the base directory. This exploitation can lead to remote code execution by injecting malicious payloads into files that are executed by the server.

To address this vulnerability, implement path validation to ensure that resolved file paths do not escape the designated base directory. Additionally, reject filenames that contain traversal sequences or that start with a slash. Adding authentication to the file management endpoints and running the server with restricted filesystem permissions can further mitigate the risk.