CVE-2026-105032: EnergizeLab Eilik/EilikO AI Skill Upload Path Traversal

Executive Summary

CVSS Score: 9.1 (Critical)

A critical unauthenticated path-traversal vulnerability has been disclosed in the FastAPI-based AI inference and profiling service that powers EnergizeLab's Eilik and EilikO devices — small AI-powered desktop "companion robots." Tracked as CVE-2026-105032, the flaw sits in the service's AI skill upload endpoint: it requires no authentication at all, and it does not constrain the file paths supplied in an upload request.

In plain terms, anyone who can reach the service over the network can submit a crafted "skill" upload whose filename contains directory-traversal sequences and have the service write that file somewhere outside the intended skill-storage directory — a textbook arbitrary file write. No login, token, or device pairing is required.

CVE-2026-105032 was published 2026-10-15 alongside a batch of other EnergizeLab vulnerabilities disclosed by the same researcher (see "Related Vulnerabilities" below).

Vulnerability Overview

Note the CVSS vector's impact subscores: no confidentiality impact, but high integrity and high availability impact (C:N/I:H/A:H). This is consistent with a pure arbitrary-file-write bug rather than a data-disclosure one — the danger is in what gets overwritten or planted, not in reading existing files.

Affected Versions and Patches

Public advisories (NVD, the GitHub Security Advisory GHSA-vc56-v8qw-rhr8, VulDB, and Strix.ai) all list affected and patched versions as not specified / unknown. No vendor advisory, firmware changelog, or confirmed patched build has surfaced as of this writing. Coverage of the broader EnergizeLab disclosure batch notes the vendor did not respond to the researcher's reports before the public disclosure deadline passed (reported to have expired around 2026-09-18).

Treat this as unpatched until EnergizeLab publishes version-specific fix information — do not assume a recent firmware or app update has silently addressed it without vendor confirmation. The CVE record itself was reserved 2026-10-02 and published 2026-10-15.

How the Vulnerability Works

Eilik and EilikO support an "AI skill" model — presumably uploadable behavior modules or extensions that customize what the companion robot can do. The upload path for these skills is served by the same FastAPI-based AI inference/profiling backend that drives the device's model behavior (the same backend implicated in the sibling CVE-2026-105038, below).

Per the NVD description, this skill upload endpoint has two independent problems that combine into the critical rating:

1. No authentication (CWE-306-adjacent, though tracked here under CWE-22/CWE-434) — the upload route accepts requests from anyone who can reach it over the network, with no credential check.
2. No path constraint on the uploaded filename (CWE-22) — the service does not canonicalize or restrict the destination path derived from the upload request, so a filename containing traversal sequences such as ../../ can cause the write to land outside the intended skill-storage directory entirely.

Neither NVD nor the advisories reviewed for this article publish the exact route path, parameter name, or a working proof-of-concept payload — "neither technical details nor an exploit are publicly available," per VulDB's assessment, and no public PoC repository mapping this specific CVE number to a reproducible request was found during research for this article. What is consistently documented is the mechanism: unauthenticated upload + unconstrained path = write-anywhere.

Combined, an unauthenticated remote attacker can craft an upload request that:

• Targets a file path outside the intended skill directory using traversal sequences in the filename/path field
• Writes attacker-controlled content to that location
• Thereby tampers with AI skill files — and, because the write is not confined to the skill directory, potentially other files reachable by the service's process

Because the endpoint sits behind no authentication, exploitation requires no special access, no victim interaction, and no complex setup — any network path to the service is sufficient (AC:L/PR:N/UI:N in the CVSS vector).

Impact Assessment

• Integrity: High, Availability: High, Confidentiality: None per the CVSS vector — the practical risk is file tampering and the downstream effects of that, not data theft via this specific flaw.
• Device tampering: Overwriting or planting AI skill files can alter what the companion robot does and how it behaves, without the owner's awareness.
• Potential for broader file-system impact: Because the vulnerability is a path-traversal write rather than one confined to a sandboxed skill folder, the practical blast radius depends on what files the service's process account can reach — which has not been publicly characterized in detail. Treat it conservatively as "can write outside the intended directory" rather than assuming the damage is limited to skill files alone.
• No authentication barrier: With AC:L, PR:N, and UI:N in the CVSS vector, any attacker with network reachability to the service can attempt exploitation — there is no login, pairing, or session requirement standing in the way.
• Part of a larger disclosure batch: This is one of at least eight related EnergizeLab CVEs disclosed the same day, several of which (CVE-2026-105037, CVE-2026-105038, CVE-2026-105039) hit the same or adjacent components — see "Related Vulnerabilities" below. Devices affected by one are plausibly reachable for the others too.

Recommendations

1. Do not expose the AI inference/profiling service (including the skill upload endpoint) to the public internet. If it's reachable only on a LAN or via a cloud relay you control, keep it that way — don't port-forward or otherwise publish it.
2. Segment IoT/companion-device traffic from trusted networks and other devices, the same way you would for any consumer IoT device with an unclear security posture.
3. Check for a vendor patch before relying on this device for anything sensitive, and re-check periodically — no confirmed fixed version is published as of 2026-10-16.
4. Monitor for unexpected files or AI skill changes if you have the ability to inspect the device/service state — unexplained new files, modified skill definitions, or altered behavior are plausible symptoms of exploitation.
5. Watch for traversal patterns in logs (../, encoded variants, absolute paths) on any request reaching the skill upload route, if logging is available to you.
6. Track the vendor's response. Public reporting indicates EnergizeLab had not engaged with the disclosing researcher as of the public-disclosure date; watch for an official advisory or firmware update rather than assuming silence means "fixed."

Related Vulnerabilities

CVE-2026-105032 was disclosed as part of a batch of EnergizeLab Eilik/EilikO and station-middleware vulnerabilities released the same day. Related CVEs covering the same or adjacent EnergizeLab components:

• CVE-2026-105037 — Path traversal in EnergizeLab's NestJS station-middleware Docker images (1.6.5–1.8.2) allowing low-privilege users to read arbitrary server files (CVSS 9.9). See /security/energizelab-station-middleware-arbitrary-file-read-cve-2026-105037 (best-effort link — slug may vary).
• CVE-2026-105038 — Unauthenticated AI model administration on the same FastAPI inference service (CVSS 9.8). See /security/energizelab-eilik-unauthenticated-ai-model-admin-cve-2026-105038.
• CVE-2026-105039 — Missing RBAC on station-middleware admin APIs, same affected image range (CVSS 9.6). See /security/energizelab-station-middleware-missing-rbac-cve-2026-105039 (best-effort link — slug may vary).

These are covered in their own dedicated advisories; this article's technical focus is CVE-2026-105032 only.

Key Takeaways

1. CVE-2026-105032 (CVSS 9.1) lets an unauthenticated remote attacker write arbitrary files to EnergizeLab Eilik/EilikO devices via the AI skill upload endpoint on the FastAPI inference service — no login, token, or pairing required.
2. Root cause is two compounding issues: a missing authentication check on the upload endpoint, and no path canonicalization or restriction on the uploaded file's destination (CWE-22, also tracked as CWE-434).
3. The CVSS vector shows high integrity and availability impact but no confidentiality impact (C:N/I:H/A:H) — this is a file-tampering bug, not a data-theft one.
4. No confirmed patched version is publicly documented as of 2026-10-16; the vendor reportedly did not respond to the disclosing researcher before public release.
5. No exact endpoint path or public proof-of-concept was found during research for this article — treat the entire skill-upload surface as suspect rather than waiting for a specific route name.
6. This is one of several EnergizeLab CVEs disclosed the same day — if you operate Eilik, EilikO, or EnergizeLab station-middleware, review the sibling advisories too, not just this one.
7. Until a vendor fix lands, network exposure is the mitigation that matters most — keep the inference service off the public internet and segmented from trusted networks.

Sources

• NVD: CVE-2026-105032
• GitHub Advisory Database: GHSA-vc56-v8qw-rhr8
• Strix.ai: CVE-2026-105032
• AHA! (takeonme.org): Multiple EnergizeLab Eilik/Eiliko Platform Vulnerabilities
• VulDB: CVE-2026-105032 EnergizeLab FastAPI Upload Endpoint path traversal