CVE-2026-51859

Name of the Vulnerable Software and Affected Versions bisheng versions 2.3.0 through 2.4.0

Description A directory traversal issue exists in the save download file() function (located in src/backend/bisheng/core/cache/utils.py:290). Directory traversal is a flaw that allows an attacker to access files and directories that are stored outside the web root folder by manipulating variables that reference files with input that is not properly neutralized.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting the use of the save download file() function until a patch is available.