Description
deeptutor 1.4.0 contains a path traversal issue in EditFileTool.execute. Through the live tutorbot WebSocket interface, a remote caller can induce the tool layer to write or edit absolute paths outside the intended bot workspace.
Critical · 9.8
CVE-2026-51880
EUVD-2026-91125GHSA-45p5-w2r8-mrfv
deeptutor 1.4.0 contains a path traversal issue in EditFileTool.execute. Through the live tutorbot WebSocket interface, a remote caller can…
Published Oct 1, 2026 · Updated Oct 5, 2026 · Assigned by mitre