CVE-2026-105032

Summary

The EnergizeLab Eilik and EilikO AI skill upload endpoint allows unauthenticated path traversal attacks, enabling remote attackers to write arbitrary files to the system. This vulnerability is critical because it can lead to complete compromise of the AI inference services and potentially the underlying robot systems.

Exploitability

Exploitation is straightforward for unauthenticated remote attackers who can craft malicious file uploads with path traversal sequences, requiring no additional authentication or privileges beyond network access to the vulnerable endpoint.

Blast radius

The impact could be severe across all Eilik and EilikO robots using the vulnerable AI inference services, potentially allowing attackers to modify AI skills, inject malicious code, or disrupt robot operations through compromised inference services.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Disable the AI skill upload endpoint immediately or implement mandatory authentication for all file upload operations, as no fixed version is published in the description.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.