Get real-time updates on Telegram
CVE-2026-13381: clinic 7.1.26; +2 more affected products
CVE-2026-13381. CVSS 3.1 base score 8.1 (HIGH, NVD). EPSS 0.00367 (percentile 0.2947), scored 24-Oct-2026.
Affected technology
clinic · 7.1.26
vsee
clinic api · 1.3.0
vsee
Clinic · 7.1.26 to before 7.1.26.1
VSee
Clinic · 1.3.0 to before 1.3.0.1
VSee
Description’s affected range: 7.1.26 and API 1.3.0
Component: API
Attack conditions (Source advisory, CVSS 4.0): Network (remote) · Low privileges required · No user interaction required
What an attacker can do
An authenticated attacker can manipulate the 'remark' request parameter to enumerate, retrieve, and delete files belonging to other users on the application server. Source advisory’s CVSS 4.0 assessment (base score 8.7/10) rates confidentiality, integrity and availability impact as high.
- CWE
- CWE-639
- CCR priority
- 32.5 /100 (P4)
- CVSS 3.1
- 8.1 /10 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N · NVD
- EPSS
- 0.00367 · percentile 0.2947 · 2026-10-24
- KEV
- no
Provenance
- NVD CVE API 2.0 · Source record · observed 2026-10-25 01:28:19.133527+00:00 UTC
Stable permalink: https://cybercodered.org/item/cve-cve-2026-13381.html