PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-7302 SGLang CVE debrief

CVE-2026-7302 is an unauthenticated path traversal issue reported for SGLang’s multimodal generation runtime. The flaw can let an attacker place files outside the intended upload path by using ../ sequences in an upload filename, potentially writing anywhere the server process has permission to write. Because the issue is unauthenticated and impacts file integrity on the host, it deserves prompt review even though the public record here does not include CVSS data.

Vendor
SGLang
Product
Unknown
CVSS
CRITICAL 9.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-18
Original CVE updated
2026-05-19
Advisory published
2026-05-18
Advisory updated
2026-05-19

Who should care

Teams running SGLang, especially deployments that expose upload-related endpoints to untrusted users, should treat this as a priority file-integrity risk. Security and platform owners should also review any service account or container permissions that could turn arbitrary file write into broader system impact.

Technical summary

The supplied record describes a path traversal weakness in SGLang’s multimodal generation runtime. By embedding ../ sequences in an upload filename sent to specific endpoints, an attacker may escape the intended directory and write arbitrary files wherever the server process has write access. The available corpus does not identify the exact endpoints or confirm any secondary impact beyond file write.

Defensive priority

High

Recommended defensive actions

  • Patch or upgrade SGLang to a fixed release once available from the project maintainers.
  • Restrict access to any upload or file-ingest endpoints until remediation is in place.
  • Run the service with the least possible filesystem permissions so arbitrary writes have limited blast radius.
  • Validate and normalize all upload filenames server-side; reject path traversal sequences and absolute paths.
  • Place the runtime in a container or sandbox with a read-only root filesystem where feasible.
  • Review logs for suspicious upload names containing ../ or unusual file placement attempts.

Evidence notes

This debrief is based only on the supplied NVD record and its cited references. The NVD item states the vulnerability is a path traversal in SGLang and links to an Antiproof writeup plus the SGLang repository. The corpus does not include a confirmed vendor mapping, exact vulnerable endpoints, or CVSS metrics, so those details are intentionally left unspecified.

Official resources

The CVE was published on 2026-05-18, and the supplied source record shows the NVD item in Received status at the same timestamp. The public references provided with the record point to a third-party writeup and the upstream SGLang codebase;