CVE-2026-7271

A vulnerability was detected in DV0x creative-ad-agent up to 751b9e5146604dc65049bd0f62dcbdad6212f8a3. Impacted is an unknown function of the file server/sdk-server.ts of the component creative-ad-agent-server. Performing a manipulation of the argument req.params results in path traversal. Remote exploitation of the attack is possible. The exploit is now public and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The patch is named 3d255865a957f3740b8724dd914502c0f44d4970. Applying a patch is the recommended action to fix this issue.

• CWE-22

• https://github.com/DV0x/creative-ad-agent/
• https://github.com/DV0x/creative-ad-agent/commit/3d255865a957f3740b8724dd914502c0f44d4970
• https://github.com/DV0x/creative-ad-agent/issues/1
• https://vuldb.com/submit/802887
• https://vuldb.com/vuln/359926
• https://vuldb.com/vuln/359926/cti

Published

Apr 28, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-72702Grav CMS before 2.0.16 contains an origin validation bypass …5.4
• CVE-2026-72703The guard checker in Rocq Prover treats a parameter of a nes…6.3
• CVE-2026-72704The guard checker in Rocq Prover does not recheck the recurs…6.3
• CVE-2026-72705The guard checker in Rocq Prover does not follow recursive c…6.3
• CVE-2026-72708SPIP before 4.4.18 contains an unauthenticated blind SQL inj…7.5
• CVE-2026-72709SPIP before version 4.4.18 contains a missing authorization …9.8
• CVE-2026-72710SPIP before 4.4.18 contains a mass assignment vulnerability …9.8
• CVE-2026-72711The Lean 4 kernel does not check that the body of an opaque …6.3
• CVE-2026-72712Nmap versions up to and including 7.99 contains a denial of …6.5
• CVE-2026-72713XAgent contains a path traversal vulnerability in the worksp…7.5
• CVE-2026-72714Rocq Prover does not restore the universe graph's copy of th…6.3
• CVE-2026-72716Orval generates type-safe JavaScript clients in TypeScript f…9.3