CVE-2026-82112 Overview
CVE-2026-82112 is a path traversal vulnerability [CWE-22] affecting houtini-ai houtini-lm through version 2.13.2. The flaw resides in an unknown function within src/index.ts in the code_task_files component. An attacker can manipulate file path input to access files outside the intended directory. The attack is exploitable remotely and requires low privileges plus user interaction. The maintainers addressed the issue in commit 35d97bca0531894da36a85aedb95312da1bd5b7a.
Critical Impact
Remote path traversal enabling unauthorized read access to files outside the intended directory scope in houtini-lm through 2.13.2.
Affected Products
- houtini-ai houtini-lm up to and including version 2.13.2
- Component: code_task_files in src/index.ts
- Distribution: houtini-lm GitHub repository
Discovery Timeline
- 2026-08-28 - CVE-2026-82112 published to NVD
- 2026-08-28 - Last updated in NVD database
Technical Details for CVE-2026-82112
Vulnerability Analysis
The vulnerability is a path traversal weakness classified under CWE-22. It exists in the code_task_files component of houtini-lm, specifically inside src/index.ts. The impacted function accepts file path input from a remote source without adequate sanitization of directory traversal sequences.
An attacker who supplies crafted path segments such as ../ can escape the intended base directory. The result is unauthorized read access to files elsewhere on the host running the service. Exploitation requires low-level privileges and some user interaction, according to the CVSS 4.0 vector.
Root Cause
The root cause is missing or insufficient canonicalization of user-supplied file paths in the code_task_files handler. The affected code concatenates untrusted input into a file system path without verifying that the resolved path remains within a permitted base directory. This omission allows relative traversal sequences to reach parent directories.
Attack Vector
The attack is delivered over the network against an exposed houtini-lm instance. An authenticated attacker submits a request to the code_task_files component containing a path parameter with traversal segments. The service resolves the manipulated path and returns file contents outside the intended working directory. See the upstream fix commit and Pull Request #11 for the patched logic.
No verified public exploit code is available. Refer to the VulDB entry for CVE-2026-82112 for additional technical context.
Detection Methods for CVE-2026-82112
Indicators of Compromise
- Requests to houtini-lm endpoints containing traversal sequences such as ../, ..\, or URL-encoded variants (%2e%2e%2f) in file path parameters.
- Application logs showing file reads outside the expected code_task_files working directory.
- Access attempts targeting sensitive system files (for example /etc/passwd, .env, or SSH keys) through houtini-lm request handlers.
Detection Strategies
- Inspect HTTP request payloads and query parameters for directory traversal patterns before they reach the houtini-lm process.
- Enable verbose file access logging on the process user and alert on reads outside the designated working directory.
- Compare deployed houtini-lm commit hashes against 35d97bca0531894da36a85aedb95312da1bd5b7a to identify unpatched instances.
Monitoring Recommendations
- Monitor Node.js process file descriptors for reads targeting paths that resolve outside the application root.
- Alert on any 4xx or 5xx responses correlated with traversal payloads in request logs.
- Track outbound file content in responses to identify unexpected disclosure of source or configuration files.
How to Mitigate CVE-2026-82112
Immediate Actions Required
- Upgrade houtini-lm to a version that includes commit 35d97bca0531894da36a85aedb95312da1bd5b7a or later.
- Restrict network exposure of houtini-lm so that only trusted, authenticated callers can reach the code_task_files component.
- Audit access logs for prior traversal attempts and review any files that may have been disclosed.
Patch Information
The maintainers merged the fix in Pull Request #11 with commit hash 35d97bca0531894da36a85aedb95312da1bd5b7a. Review the patch commit and the maintainer discussion for implementation details. Users of houtini-lm through 2.13.2 should update to the patched release.
Workarounds
- Run houtini-lm under a low-privilege service account with file system permissions limited to the required working directory.
- Place a reverse proxy or web application firewall in front of houtini-lm to block traversal patterns in path parameters.
- Use OS-level sandboxing (containers, chroot, AppArmor, or SELinux) to constrain the process to a minimal file system view.
# Configuration example
# Update houtini-lm to the patched revision
git -C /opt/houtini-lm fetch origin
git -C /opt/houtini-lm checkout 35d97bca0531894da36a85aedb95312da1bd5b7a
npm --prefix /opt/houtini-lm ci
systemctl restart houtini-lm
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
