TEN Framework - Arbitrary File Read & Write
CVE-2026-85688
Verified
Description
TEN Framework 0.11.71 contains unauthenticated arbitrary file read and write vulnerabilities in the TMAN Designer file-content API endpoints, letting attackers read or write arbitrary files and execute code. The exploit requires no authentication.
Severity
Critical
CVSS Score
9.8
Exploit Probability
3%
Affected Product
ten-framework
Published Date
September 18, 2026
Template Author
aryu-ru, geo-chen
CVE-2026-85688.yaml
9.8Score
CVSS Metrics
CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE ID:
cve-2026-85688
CWE ID:
cwe-306
References
https://www.vulncheck.com/advisories/ten-framework-0.11.71-unauthenticated-file-read-write-via-tman-designerhttps://github.com/TEN-framework/ten-framework/issues/2187https://github.com/TEN-framework/ten-framework/blob/0.11.71/core/src/ten_manager/src/designer/file_content/mod.rshttps://nvd.nist.gov/vuln/detail/CVE-2026-85688
Remediation Steps
Update to the latest version of TEN Framework.