{"id":"CVE-2026-51873","published":"2026-10-01T22:17:02.017","lastModified":"2026-10-06T16:17:07.723","description":"Devika v1.0 is vulnerable to Directory Traversal in the Coder.save_code_to_project function, which allows attackers to write files outside the intended project workspace.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-22"],"vendors":[],"products":[],"references":[{"url":"https://gist.github.com/Ro1ME/946b670dfefd594a123ed4527de34088","tags":[]},{"url":"https://github.com/stitionai/devika/issues/707","tags":[]},{"url":"https://github.com/stitionai/devika/issues/707","tags":[]}],"exploitRefs":[{"url":"https://gist.github.com/Ro1ME/946b670dfefd594a123ed4527de34088","tags":[]},{"url":"https://github.com/stitionai/devika/issues/707","tags":[]},{"url":"https://github.com/stitionai/devika/issues/707","tags":[]}],"hasPoc":true,"ai":{"summary":"Devika v1.0 allows attackers to write files outside the intended project workspace through a directory traversal vulnerability, enabling unauthorized file manipulation.","exploitability":"Exploitation requires knowledge of the target project directory structure and access to the Coder.save_code_to_project function. Precondition is the attacker must have low-level privileges.","blast_radius":"If exploited, attackers could gain control over files outside the project workspace, potentially leading to data loss or system compromise.","remediation":"Upgrade to Devika v2.0 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["directory-traversal","file-write","vulnerability"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-07T08:44:12.804Z"}}