CVE-2026-85688

TEN Framework 0.11.71 exposes unauthenticated arbitrary file read and write functionality through TMAN Designer's file-content API endpoints (CWE-306, missing authentication for a critical function), and carries a critical CVSS 4.0 score of 9.3 with a network attack vector requiring no privileges or user interaction. An attacker triggers the flaw by sending crafted POST or PUT requests to /api/designer/v1/file-content, which allow reading arbitrary files on the host or writing attacker-controlled content to system paths. By writing to files such as authorized_keys, cron files, or executable graph files, the attacker can turn the file-write primitive into arbitrary code execution on the affected machine. Any deployment of TEN Framework 0.11.71 whose TMAN Designer API is reachable by untrusted network clients is affected. No public proof-of-concept is known, the issue is not in CISA KEV, and EPSS assigns a 0.4% 30-day exploitation probability (34th percentile), so no in-the-wild exploitation is currently confirmed.

What to do: Upgrade TEN Framework to a release newer than 0.11.71 that remediates the TMAN Designer file-content endpoints (the fixed version is not specified in the available data, so check the project's advisories), or restrict network access so only trusted clients can reach /api/designer/v1/file-content. On affected hosts, review authorized_keys files, cron files, and executable graph files for unexpected modifications that would indicate read/write abuse or code execution.