EnergizeLab station-middleware: Path traversal enables arbitrary file read
Summary
EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 do not properly validate file paths supplied by users. Any registered account with low privileges can read arbitrary files on the server, which exposes middleware files and server secrets. The CVSS score is 9.9 (critical) according to the CNA, while VulDB rates it 4.3; NVD analysis is still pending.
Affected
- EnergizeLab station-middleware Docker images 1.6.5 to 1.8.2 (default configuration: unaffected)
- Authentication with any registered, low-privilege account is required
Fixed in
Unknown. No fixed version or vendor advisory was found at the time of research.
Workaround
- Restrict network access to the middleware so that only required clients can reach it
- Review web server, application and filesystem logs for path traversal sequences in requests
- Review the list of registered users and disable unneeded accounts
Exploitation
- Not listed in CISA KEV
- CISA SSVC: exploitation none, automatable no, total technical impact
- VulDB states that no exploit exists
- A public write-up by the researcher exists; whether working exploit material exists is unclear
Our recommendation
- Check whether any system runs EnergizeLab station-middleware 1.6.5 to 1.8.2; if not, record the CVE as not applicable
- If it runs, remove direct internet exposure and restrict access to required clients
- Review logs, rotate secrets the middleware holds (API keys, environment variables) and monitor the vendor and NVD for a fixed version
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Researcher repository: your-secrets-are-safe-with-me github.com
- AHA/TakeOnMe advisory: EnergizeLab Eilik/EilikO platform vulnerabilities takeonme.org
- OpenCVE: CVE-2026-105037 app.opencve.io
- VulDB: vuln 420902 vuldb.com
- Strix: CVE-2026-105037 www.strix.ai
- TheHackerWire: CVE-2026-105037 www.thehackerwire.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 15:18.
Original description (NVD)
EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 allow any registered, low-privilege account to read arbitrary files from the server by supplying an attacker-controlled file path. This exposes middleware files and server secrets.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.