CVE-2026-10044
Description
Usagi-org ai-goofish-monitor contains an unauthenticated arbitrary file read vulnerability in the GET /api/prompts/{filename} endpoint on Windows deployments that allows unauthenticated remote attackers to read arbitrary files by supplying absolute Windows paths or backslash-based traversal sequences. Attackers can bypass the incomplete path traversal guard, which only blocks forward slashes and '..', by providing absolute paths such as Windows system file locations, causing os.path.join to discard the intended prompts directory prefix and expose files accessible to the application process.
How to fix
- Usagi-org ai-goofish-monitorf85d140b6b45029d9a0925feb96dad733b41396d or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Usagi-org ai-goofish-monitor | v < f85d140b6b45029d9a0925feb96dad733b41396d | f85d140b6b45029d9a0925feb96dad733b41396d |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.