CVE-2026-7302

CriticalCVSS 9.1/10Last modified Oct 14, 2026

Description

SGLangs multimodal generation runtime is vulnerable to an unauthenticated path traversal vulnerability, allowing an attacker to write arbitrary files anywhere the server process has write access, by including ../ sequences in the upload filename when sent to specific endpoints.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-35

Affected software

Vendor	Product	Versions
SGLang	SGLang	5.10

References

https://antiproof.ai/blog/three-rces-in-sglang/Permissions Required
https://github.com/sgl-project/sglang/tree/main/python/sglangProduct

Timeline

Published: May 18, 2026
Last modified: Oct 14, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-730207.8Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.CVE-2026-730217.8Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.CVE-2026-730227.0Use after free in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally.CVE-2026-730238.8Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code over a network.CVE-2026-730247.8Heap-based buffer overflow in Windows Services for NFS ONCRPC XDR Driver allows an authorized attacker to elevate privileges locally.CVE-2026-730259.8Weak authentication in Windows iSCSI allows an unauthorized attacker to bypass a security feature over a network.CVE-2026-730267.8Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.CVE-2026-730277.8External control of system or configuration setting in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges local CVE-2026-730288.8Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network.CVE-2026-730296.5Buffer over-read in SQL Server allows an authorized attacker to disclose information over a network.CVE-2026-73033.7A security flaw has been discovered in Xuxueli xxl-job up to 3.3.2. Impacted is the function logDetailCat of the file xxl-job-admin/src/main CVE-2026-730308.1unearth through 0.18.2, fixed in commit 6c78164, contains a path traversal vulnerability in the is_within_directory function that fails to n