CVE-2026-51859

bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to directory traversal in save_download_file (src/backend/bisheng/core/cache/utils.py:290).

• Published Sep 30, 2026
• CVSS 9.1 critical
• 0.7% chance of exploitation in the next 30 days (EPSS)

CVE-2026-51859 at the National Vulnerability Database