Low severity · published Oct 13, 2026
CVE-2026-109526
HBAI-Ltd Toonflow-app exportData Endpoint information disclosure
3.3
CVSS
0.1%
EPSS
No
On KEV
Description
A vulnerability has been found in HBAI-Ltd Toonflow-app up to 1.1.8. This affects an unknown function of the component exportData Endpoint. Such manipulation leads to information disclosure. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. Upgrading to version 2.0.0 mitigates this issue. It is advisable to upgrade the affected component. The vendor explains: "The report targets ToonFlow version 1.1.8. The current release is 2.0.4, which is the result of a substantial architectural refactor; the code paths referenced in the report do not apply to the current version. The report does not describe a vulnerability in any supported release."
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 1% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TO
Toonflow-app · HBAI-Ltd
1.1.0; 1.1.1; 1.1.2; 1.1.3; 1.1.4; 1.1.5; +3 more · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-109526
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-109526
vdb-entry
https://vuldb.com/vuln/417195
signature
https://vuldb.com/vuln/417195/cti
third-party-advisory
https://vuldb.com/cve/CVE-2026-109526
third-party-advisory
https://vuldb.com/submit/984380
exploit
https://drive.google.com/drive/folders/13MjPi0zInT9Caau_fqD68FQ0z5fH0YsX?usp=sharing
patch
https://github.com/HBAI-Ltd/Toonflow-app/releases/tag/v2.0.0
More from Toonflow-app
6.3
CVE-2026-7084
HBAI-Ltd Toonflow-app getCodeByLink Endpoint getCodeByLink.ts fetch server-side request forgery
5.3
CVE-2026-109409
HBAI-Ltd Toonflow-app Open Folder Endpoint openFolder.ts child_process.exec command injection
5.0
CVE-2026-7085
HBAI-Ltd Toonflow-app downloadApp Endpoint downloadApp.ts z.url path traversal
4.3
CVE-2026-7086
HBAI-Ltd Toonflow-app Storyboard Export replaceUrl.ts updateStoryboardUrl path traversal