CVE Intelligence
Analysis AI-assisted

CVE-2026-44449: Lumiverse: SMB path handling argument injection in exists()

CVE-2026-44449 affects Lumiverse before 0.9.7. When the primary path conversion fails, a fallback validates only the directory part, so unvalidated basename content can reach an smbclient script and be interpreted as commands. The CNA rates it critical with CVSS 3.1 score 9.1, and the sources consulted show no confirmed exploitation.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

Lumiverse is an AI chat application. CVE-2026-44449 describes a flaw in its SMB path handling in the exists() method. When the primary path conversion fails, a fallback validates only the directory component, leaving the basename unvalidated before it is passed to smbclient.

Impact

The record describes arbitrary command execution on the Lumiverse server. The CVSS 3.1 base score is 9.1 (Critical), with vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, as reported by the CNA and GitHub. The assigned weakness is CWE-88 (Argument Injection).

Affected products and versions

  • Prolix-oc Lumiverse, versions before 0.9.7.

The record has no separate fixed-version field. Its description states that the issue is fixed in 0.9.7.

Exploitation status

CISA KEV does not list this CVE. The EPSS probability is 0.00856 (percentile 0.57309), and SSVC marks exploitation as poc and automatable as no. No confirmed exploitation appears in the sources consulted.

Remediation and mitigation

  • Upgrade Lumiverse to version 0.9.7 or later, as stated in the record.
  • Review the GHSA-4v38-9hqq-7j53 advisory for maintainer guidance.
  • Until the upgrade, limit which users can reach file-path features that use SMB, and restrict the server's network access to SMB shares.
  • Run the service with least privilege so that a compromise has a limited scope.

Detection guidance

  • Log and review SMB-related path inputs for unusual characters in file names, especially shell separators and escape characters.
  • Monitor the Lumiverse host for unexpected child processes spawned by the application or by smbclient.
  • Alert on unexpected outbound connections or new local accounts originating from the server.

Limitations of the available information

The record does not describe the exact conditions needed to reach the fallback path, and it has no fixed-version field. The source status is Deferred. Whether a given deployment uses the affected code path is unknown. The analysis relies on the record and the cited advisory only.

Frequently asked questions

Is this CVE known to be exploited?

CISA KEV does not list it, and no confirmed exploitation appears in the sources consulted. The SSVC exploitation value is poc.

Which version fixes the issue?

The record description states that version 0.9.7 fixes the issue. The record has no separate fixed-version field, so check the advisory for details.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.