PT-2026-29477 · Sanster · Sanster Iopaint

Vuldb + 1 · Published 2026-04-01 · Updated 2026-04-01 · CVE-2026-5258

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Sanster IOPaint version 1.5.3

Description A path traversal issue exists in the File Manager component of Sanster IOPaint version 1.5.3, specifically within the get file function of the iopaint/file manager/file manager.py file. Manipulation of the filename argument can lead to path traversal. The exploit has been made public and is possible to be carried out remotely. The vendor was contacted but did not respond.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the iopaint/file manager/file manager.py file.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-5258

Affected Products

Sanster Iopaint

References · 7

• 🔥 https://github.com/August829/CVEP/issues/11 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-5258 · Security Note
• https://twitter.com/CVEnew/status/2039279647196901528 · Twitter Post
• https://vuldb.com/submit/780666 · Note
• https://vuldb.com/vuln/354448 · Note
• https://twitter.com/cyberbivash/status/2039248281457316125 · Twitter Post
• https://vuldb.com/vuln/354448/cti · Note