CVE-2026-7302

SGLangs multimodal generation runtime is vulnerable to an unauthenticated path traversal vulnerability, allowing an attacker to write arbitrary files anywhere the server process has write access, by including ../ sequences in the upload filename when sent to specific endpoints.

CVSS 3.1

9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

EPSS

0.4% chance of exploitation in the next 30 days; higher than 32% of CVEs (scores of 2026-10-25)

CWE

CWE-35

Published

2026-05-18

Modified

2026-10-14

Record from

the NVD, synced 2026-10-19

Affected

• lmsys:sglang

Packages (OSV)

References

• https://antiproof.ai/blog/three-rces-in-sglang/
• https://github.com/sgl-project/sglang/tree/main/python/sglang

Check your stackJSON