CVE-2026-101080

Executive Summary

CVE-2026-101080 is a path traversal vulnerability in Tencent AI-Infra-Guard versions up to 4.5.2 and 4.6.2, specifically within the startsWith function of skill_scan/tools/dir/dir_actions.py in the File Access component. The flaw requires local access and user interaction, with a CVSS score of 4.8 (Medium), and a public exploit is reportedly available. Organizations using vulnerable versions should prioritize upgrading to version 4.6.0 or applying the patch identified by ac0384edc9dbea3b226edefcf50613bd8509134f to mitigate the risk of local path traversal attacks.

Technical Analysis

The vulnerability resides in the startsWith function within the file skill_scan/tools/dir/dir_actions.py, which is part of the File Access component of Tencent AI-Infra-Guard. This function is likely used to validate or compare file paths, and its flawed implementation permits path traversal (CWE-22). An attacker with local access can manipulate input to bypass intended directory restrictions, potentially accessing files outside the intended scope. The attack requires user interaction (UI:R), meaning the victim must perform some action, such as opening a crafted file or executing a script. The CVSS vector (AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L) indicates low complexity and low privileges required, with limited impact on confidentiality, integrity, and availability. Upgrading to version 4.6.0 mitigates the issue, as the patch addresses the path validation logic in the startsWith function.

Exploitation Scenarios

No public proof-of-concept (PoC) is available, but the exploit is stated to be publicly available, suggesting potential for exploitation. The attack chain, inferred from the vulnerability class, proceeds as follows:

1. Reconnaissance/Target Identification: The attacker identifies a system running a vulnerable version of Tencent AI-Infra-Guard (up to 4.5.2/4.6.2) and gains local access, either through physical access, a compromised user account, or a social engineering vector.
2. Triggering the Flaw: The attacker crafts input that manipulates the path handling in the startsWith function of dir_actions.py. This could involve a malicious file or directory name containing path traversal sequences (e.g., ../) that the function fails to properly validate.
3. Payload/Execution: The attacker executes the crafted input locally, potentially through a script or by interacting with the application's file access functionality. The path traversal allows reading or writing files outside the intended directory, depending on how the function's output is used.
4. Post-Exploitation Impact: Successful exploitation could lead to unauthorized access to sensitive files (confidentiality impact), modification of files (integrity impact), or disruption of service (availability impact). The limited scope (S:U) suggests the attacker remains within the application's security context.

Due to insufficient technical detail, specific payloads or exact function calls cannot be provided. The attack is constrained by the need for local access and user interaction.

Impact Assessment

The vulnerability has a CVSS score of 4.8, categorized as Medium severity. The impact is limited: confidentiality, integrity, and availability are each rated as Low (C:L/I:L/A:L), meaning the attacker can access some files, modify some data, or cause minor disruptions, but not complete system compromise. The scope is unchanged (S:U), so the attack does not affect other components. Affected systems are those running Tencent AI-Infra-Guard versions up to 4.5.2 or 4.6.2. The blast radius is constrained to the local environment where the vulnerable application is installed, and the requirement for user interaction reduces the likelihood of widespread exploitation. However, the public availability of the exploit increases the risk for targeted attacks.

Detection Guidance

Sigma Rule

title: Potential Path Traversal in Tencent AI-Infra-Guard via dir_actions.py
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects suspicious file access patterns indicative of path traversal exploitation in Tencent AI-Infra-Guard.
author: Threat Intelligence Team
date: 2026-01-15
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\python.exe'
    CommandLine|contains:
      - 'dir_actions.py'
      - 'skill_scan'
      - '../'
      - '..\\'
  condition: selection
falsepositives:
  - Legitimate administrative scripts
level: medium
tags:
  - attack.t1190
  - cve.2026-101080

YARA Rule

rule CVE_2026_101080_Path_Traversal
{
    meta:
        description = "Detects exploitation attempts of CVE-2026-101080 in Tencent AI-Infra-Guard"
        author = "Threat Intelligence Team"
        date = "2026-01-15"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-101080"
        severity = "medium"
    strings:
        $s1 = "dir_actions.py" ascii wide
        $s2 = "startsWith" ascii wide
        $s3 = "skill_scan/tools/dir" ascii wide
        $s4 = "../" ascii wide
        $s5 = "..\\" ascii wide
    condition:
        any of ($s1, $s2, $s3) and any of ($s4, $s5)
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-101080 Tencent AI-Infra-Guard Path Traversal Attempt"; flow:to_server,established; content:"dir_actions.py"; nocase; content:"../"; distance:0; within:100; classtype:attempted-user; reference:cve,2026-101080; sid:1000001; rev:1;)

Elastic Detection

process where process.name == "python.exe" and process.command_line : "*dir_actions.py*" and process.command_line : "*../*"

Splunk SPL Query

index=main sourcetype=WinEventLog:Security EventCode=4688
| search (CommandLine="*dir_actions.py*" OR CommandLine="*skill_scan*") AND (CommandLine="*../*" OR CommandLine="*..\\*")
| table _time, host, user, CommandLine, ParentCommandLine

Wazuh OSSEC Rule

<group name="tencent,ai-infra-guard,">
  <rule id="100001" level="7">
    <decoded_as>json</decoded_as>
    <field name="command">\.\./|\.\.\\</field>
    <description>CVE-2026-101080: Potential path traversal attempt in Tencent AI-Infra-Guard</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate Mitigations: Restrict local access to systems running Tencent AI-Infra-Guard. Enforce strict user permissions and avoid running the application with elevated privileges. Monitor for suspicious file access patterns as described in the detection rules.
2. Patch/Upgrade Steps: Upgrade to version 4.6.0 or later. The patch identifier ac0384edc9dbea3b226edefcf50613bd8509134f addresses the path traversal issue. Verify the upgrade through official Tencent channels.
3. Long-Term Hardening: Implement input validation for all file path operations, particularly in the startsWith function. Conduct regular security audits and code reviews for path traversal vulnerabilities. Apply the principle of least privilege to application processes and ensure user interaction prompts are clear and secure.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-101080
• Tencent AI-Infra-Guard Official Site (advisory pending)
• CWE-22: https://cwe.mitre.org/data/definitions/22.html
• Patch Reference: ac0384edc9dbea3b226edefcf50613bd8509134f
• No known threat actor campaigns or exploit-in-the-wild evidence at this time.