CVE-2026-105032

Name of the Vulnerable Software and Affected Versions EnergizeLab Eilik and EilikO (affected versions not specified)

Description The AI skill upload endpoint, served by the FastAPI AI inference and profiling services, lacks authentication and does not restrict uploaded file paths. This allows an unauthenticated remote attacker to perform path traversal—a method of accessing files and directories that are stored outside the web root folder—to write arbitrary files and tamper with AI skill files used by the robots.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.