CVE-2026-8757: adenhq hive Path Traversal Vulnerability

A path traversal vulnerability, identified as CVE-2026-8757, affects adenhq hive versions up to 0.11.0. The vulnerability resides in the _read_events_tail function within the core/framework/server/routes_sessions.py file, specifically in the Delete Request Handler component. A remote attacker can exploit this flaw by manipulating input, potentially leading to unauthorized access to sensitive files on the server. Public exploits are available, increasing the risk of exploitation. The vendor was notified but did not respond to the disclosure.

Attack Chain

1. The attacker identifies an adenhq hive instance running a vulnerable version (<= 0.11.0).
2. The attacker crafts a malicious request targeting the _read_events_tail function within the core/framework/server/routes_sessions.py file.
3. The malicious request includes path traversal sequences (e.g., ../) in the input parameters.
4. The server-side application fails to properly sanitize the input, allowing the path traversal sequence to be processed.
5. The application attempts to read a file based on the manipulated path.
6. Due to the path traversal, the application accesses a file outside of the intended directory.
7. The attacker retrieves the contents of the unauthorized file.
8. The attacker uses the gained information for further malicious activities, such as privilege escalation or data exfiltration.

Impact

Successful exploitation of this vulnerability could allow an attacker to read arbitrary files on the affected system. This may lead to the disclosure of sensitive information, such as configuration files, credentials, or internal application data. The severity is heightened by the availability of public exploits, making exploitation easier for attackers. The lack of vendor response also increases the risk.

Recommendation

• Apply appropriate input validation and sanitization techniques to prevent path traversal attacks in web applications. Specifically, focus on requests targeting core/framework/server/routes_sessions.py (reference: content).
• Deploy the Sigma rule Detect CVE-2026-8757 Exploitation -- Path Traversal Attempt to identify potential exploitation attempts targeting the affected function.
• Monitor web server logs for suspicious requests containing path traversal sequences such as “../” (reference: Attack Chain).