PT-2026-35352 · Hbai · Toonflow-App

Yu-Bao · Published 2026-04-27 · Updated 2026-04-27 · CVE-2026-7086

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions HBAI-Ltd Toonflow-app versions prior to 1.1.2

Description A path traversal issue exists in the Storyboard Export component within the updateStoryboardUrl() function of the replaceUrl.ts file. Remote attackers can exploit this by manipulating the url argument. The vendor states that the interface URL is intended to be a local address or a trusted domain configured in docker, and malicious links should not be present unless the code is modified.

Recommendations Update to a version later than 1.1.1. As a temporary workaround, restrict access to the updateStoryboardUrl() function to prevent unauthorized manipulation of the url argument.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-7086

Affected Products

Toonflow-App

References · 10

• 🔥 https://github.com/HBAI-Ltd/Toonflow-app/issues/97 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-7086 · Security Note
• https://github.com/HBAI-Ltd/Toonflow-app/issues/97#issuecomment-4208207717 · Note
• https://vuldb.com/submit/799584 · Note
• https://github.com/HBAI-Ltd/Toonflow-app · Note
• https://twitter.com/VulmonFeeds/status/2048666054025416895 · Twitter Post
• https://t.me/cveNotify/161020 · Telegram Post
• https://vuldb.com/vuln/359661 · Note
• https://vuldb.com/vuln/359661/cti · Note
• https://twitter.com/CVEnew/status/2048910098064605231 · Twitter Post