PT-2026-41669 · Sglang · Sglang

CVE-2026-7302 · Published 2026-05-18 · Updated 2026-06-29

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions SGLangs multimodal generation runtime (affected versions not specified)

Description An unauthenticated path traversal flaw allows an attacker to write arbitrary files to any location where the server process has write permissions. This is achieved by including ../ sequences in the upload filename when sending requests to specific endpoints.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-35

Related Identifiers

CVE-2026-7302

GHSA-QWRP-WGHP-94Q2

PYSEC-2026-538

Affected Products

Sglang

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/7xxx/CVE-2026-7302.json · Exploit
• https://osv.dev/vulnerability/GHSA-qwrp-wghp-94q2 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-538 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-7302 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-7302 · Security Note
• https://github.com/sgl-project/sglang · Note
• https://github.com/sgl-project/sglang/tree/main/python/sglang · Note
• https://t.me/CVEtracker/54129 · Telegram Post
• https://github.com/advisories/GHSA-qwrp-wghp-94q2 · Note
• https://t.me/cveNotify/164009 · Telegram Post
• https://reddit.com/r/SecOpsDaily/comments/1tgj9g8/vu777338_sglang_contains_two_remote_code · Reddit Post
• https://twitter.com/CVEarity/status/2056408816900866481 · Twitter Post
• https://pypi.org/project/sglang · Note
• https://antiproof.ai/blog/three-rces-in-sglang · Note
• https://twitter.com/VulmonFeeds/status/2056361272325669283 · Twitter Post