p PatchFirst

CVE-2026-7302

CVE-2026-7302

This page contains facts from public vulnerability sources. Check the original advisory before updating.

SGLangs multimodal generation runtime is vulnerable to an unauthenticated path traversal vulnerability, allowing an attacker to write arbitrary files anywhere the server process has write access, by including ../ sequences in the upload filename when sent to specific endpoints.

CVSS 9.1 · Critical · EPSS 0.4%

Published
Updated

Stack: python

Affected products and versions

  • sglang

    Versions
    • 5.10: Affected

    No fix published

  • sglang PyPI

    Versions
    • 0.5.10
    • 0.5.10.post1
    • 0.5.10rc0
    • 0.5.11
    • 0.5.12
    • 0.5.5
    • 0.5.5.post1
    • 0.5.5.post2
    • 0.5.5.post3
    • 0.5.6
    • 0.5.6.post1
    • 0.5.6.post2
    • 0.5.7
    • 0.5.8
    • 0.5.8.post1
    • 0.5.9
    Affected ranges
    • ECOSYSTEM: ≥ 0.5.5, ≤ 0.5.12

    No fix published

Original sources

Check your server →