eventcatalog CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM eventcatalog CVE published 2026-10-25

CVE-2026-116046

A path traversal vulnerability was found in the eventcatalog sdk up to version 2.29.0. This issue affects the Custom Documentation Helpers component, specifically the functions getCustomDoc, writeCustomDoc, and rmCustomDoc in the file packages/sdk/src/custom-docs.ts. The vulnerability is triggered by manipulating the options.path argument, allowing for path traversal attacks on the local host. The issue h [truncated]