GitHub Advisoryadvisory · PyPI

GHSA-qwrp-wghp-94q2 SGLang's multimodal generation runtime has an unauthenticated path traversal vulnerability

CRITICAL Published 2026-05-18 Modified 2026-05-29 Official page ↗
Aliases
CVE-2026-7302
Ecosystem
PyPI
Packages
sglang
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Weaknesses
CWE-35
Reviewed
2026-05-29

Affected packages

• PyPI sglang: >= 0.5.5, <= 0.5.12 (no fix yet)

Description

SGLang's multimodal generation runtime is vulnerable to an unauthenticated path traversal vulnerability, allowing an attacker to write arbitrary files anywhere the server process has write access, by including ../ sequences in the upload filename when sent to specific endpoints.

Related

Alias · CVE (1)

  • CVE-2026-7302 SGLangs multimodal generation runtime is vulnerable to an unauthenticated path traversal vulnerability, allowing an attacker to write… vulnerability

Weakness · CWE (1)

  • CWE-35 Path Traversal: '.../...//' weakness

References