Is CVE-2026-51880 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-51880 being exploited in the wild.

How severe is CVE-2026-51880?

Informational severity, published 1 October 2026.

Is there a fix for CVE-2026-51880?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-51880 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-51880?

Check whether you run HKUDS DeepTutor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-51880: deeptutor path traversal in EditFileTool.execute

CVE-2026-51880 · Severity: info · Published 2026-10-01

deeptutor is an AI tutoring system that uses a language model to execute file operations through a WebSocket interface. A path traversal vulnerability in the EditFileTool component allows a remote attacker to write, edit, or read files outside the intended bot workspace, potentially compromising the host system. An attacker can manipulate the LLM-backed tool layer to access arbitrary files on the filesystem where the service runs.

Technologies: HKUDS DeepTutor. Vendors: HKUDS.

Quick answers

Is CVE-2026-51880 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-51880 being exploited in the wild.
How severe is CVE-2026-51880?: Informational severity, published 1 October 2026.
Which products and versions are affected?: HKUDS DeepTutor 1.4.0.
Is there a fix for CVE-2026-51880?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-51880 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-51880?: Check whether you run HKUDS DeepTutor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in deeptutor/tutorbot/agent/tools/filesystem.py:EditFileTool.execute where file paths passed from the LLM to filesystem operations (write_file, edit_file, read_file tools) lack proper validation or sandboxing. An unauthenticated remote attacker can interact with the tutorbot WebSocket interface to trigger arbitrary absolute path writes outside the designated workspace directory. The flaw is a classic directory traversal (CWE-22) caused by missing path normalization and boundary validation.

Affected products

HKUDS deeptutor 1.4.0

Timeline

2026-05-25: disclosed: Issue opened on GitHub
2026-10-01: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.