CVE-2026-116046 | eventcatalog sdk up to 2.29.0 Custom Documentation Helpers custom-docs.ts getCustomDoc/writeCustomDoc/rmCustomDoc options.path path traversal (ID 2936)

October 24, 2026 Yanac

A vulnerability has been found in eventcatalog sdk up to 2.29.0 and classified as problematic. This vulnerability affects the function getCustomDoc/writeCustomDoc/rmCustomDoc of the file packages/sdk/src/custom-docs.ts of the component Custom Documentation Helpers. This manipulation of the argument options.path causes path traversal.

This vulnerability is handled as CVE-2026-116046. It is possible to launch the attack on the local host. There is not any exploit available.

The affected component should be upgraded.

The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.VulDB Recent EntriesRead More