CVE-2026-75797

Name of the Vulnerable Software and Affected Versions AI Engine versions prior to 3.7.2

Description The plugin fails to properly confine a caller-supplied URL when mapping it to a local filesystem path before reading the file and forwarding its contents to an external service. This allows users with a subscriber-level account to read arbitrary files from the server and exfiltrate them off-host, provided a non-default public API feature is enabled. In other configurations, the issue is reachable by an administrator, which in multisite environments allows a non-super subsite administrator to read network-shared configuration and secrets via the url parameter.

Recommendations Update AI Engine to version 3.7.2 or later. As a temporary mitigation, disable the non-default public API feature to prevent subscriber-level access to this issue. Avoid using the url parameter in the affected functionality until the update is applied.