CVE-2026-7086 — HBAI-Ltd Toonflow-App Path Traversal

title: CVE-2026-7086 - Toonflow-App Storyboard Export Path Traversal
id: scw-2026-04-27-ai-1
status: experimental
level: high
description: |
  Detects attempts to exploit CVE-2026-7086 by looking for path traversal sequences within the URI of requests targeting the Toonflow-App. The vulnerability lies in the updateStoryboardUrl function where manipulation of the url argument can lead to path traversal. This rule specifically looks for encoded path traversal characters in the URI.
author: SCW Feed Engine (AI-generated)
date: 2026-04-27
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-7086/
tags:
  - attack.initial_access
  - attack.t1190
logsource:
    category: webserver
detection:
  selection:
      cs-uri|contains:
          - '/..%252F..%252F'
      cs-method:
          - 'GET'
      condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse