CVE-2026-51859

Critical severity, CVSS 9.1. EPSS: 0.7% chance of exploitation in the next 30 days.

bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to directory traversal in save_download_file (src/backend/bisheng/core/cache/utils.py:290).

Published 2026-09-30. Last modified 2026-10-01.