CVE-2026-82635

Katalog CVE

CVSS 8.8 · High EPSS 0,63%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada faberon pake. Skor CVSS 3.1 8.8 (High) menurut jfrog.com.

Deskripsi (NVD)

Pake before 3.13.1 joins the JavaScript-supplied filename for the download_file Tauri command onto the user's Downloads directory with no sanitization. A filename containing path traversal sequences (for example ../Library/LaunchAgents/com.evil.plist) or an absolute path resolves outside ~/Downloads. The command then fetches attacker-controlled content from the supplied URL (via Rust HTTP, not the browser) and writes it to that path. A script that can invoke the command can overwrite user-writable files and install persistence (macOS LaunchAgents, Linux autostart, Windows Startup), leading to code execution in the user account. All desktop apps generated from an affected Pake tree expose the same command.

Rincian

Terbit di NVD

30 Agustus 2026

Terakhir diubah

4 September 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber jfrog.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

0,63% peluang dieksploitasi; lebih tinggi dari 48,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/tw93/Pake/commit/a5463a84d6e36705ee0dd1886cf0e4b5a75b0ab4 patch · advisory vendor
• https://github.com/tw93/Pake product
• https://github.com/tw93/Pake/releases/tag/V3.13.1 release notes