CRITICAL 9.1 NVD
CVE-2026-105032
The EnergizeLab Eilik and EilikO AI skill upload endpoint, served by the FastAPI AI inference and profiling services, does not require authentication and does n
The EnergizeLab Eilik and EilikO AI skill upload endpoint, served by the FastAPI AI inference and profiling services, does not require authentication and does not constrain uploaded file paths. An unauthenticated remote attacker can use path traversal to write arbitrary files, and thereby tamper with AI skill files used by Eilik and EilikO robots.
References
- https://github.com/xn0tsa/your-secrets-are-safe-with-me
- https://takeonme.org/gcves/GCVE-1337-2026-000000000000000000000000000000000000000000000000
- https://www.theverge.com/tech/1010727/eiliko-robot-hack-energize-lab
This critical severity vulnerability with a CVSS score of 9.1 was published on 2026-10-15 via NVD.
Risk Timeline
CVE Disclosed2026-10-15 · -1 days ago
Remediation Resources
vulnfeed aggregates 14677 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.