CVE-2026-75333

High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days.

yx-image-recognition v1.0 is vulnerable to Path Traversal. Parameters such as dir, filePath are directly passed to new File() for file system operations without any path sanitization or whitelist validation.

Published 2026-08-26. Last modified 2026-08-31.