PT-2026-41669 · Sglang · Sglang

Published 2026-05-18 · Updated 2026-05-18 · CVE-2026-7302

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions SGLangs multimodal generation runtime (affected versions not specified)

Description An unauthenticated path traversal flaw allows an attacker to write arbitrary files to any location where the server process has write permissions. This is achieved by including ../ sequences in the upload filename when sending requests to specific endpoints.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-35

Related Identifiers

CVE-2026-7302

Affected Products

Sglang

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-7302 · Security Note
• https://github.com/sgl-project/sglang/tree/main/python/sglang · Note
• https://twitter.com/CVEarity/status/2056408816900866481 · Twitter Post
• https://reddit.com/r/SecOpsDaily/comments/1tgj9g8/vu777338_sglang_contains_two_remote_code · Reddit Post
• https://twitter.com/VulmonFeeds/status/2056361272325669283 · Twitter Post
• https://twitter.com/UpwindMDR/status/2056412796644909256 · Twitter Post
• https://antiproof.ai/blog/three-rces-in-sglang · Note