CVE-2026-12511

Name of the Vulnerable Software and Affected Versions AI Engine versions prior to 3.5.5

Description Authenticated users with editor-level access or higher can perform a path traversal attack. The issue occurs because the plugin fails to sanitize a user-supplied filename before using it to write a downloaded file, allowing an attacker to write controlled bytes to an arbitrary location on the server. This could potentially lead to remote code execution.

Recommendations Update to version 3.5.5 or later.