by Kastro
Paper/Archive/CVE-2026-103648

CVE-2026-103648

demsking image-downloader — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in image-downloader

EPSS 0.5%CVSS 9.1
critical.is priorityof 100
36
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 45.7.457 × 209.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Path traversal in image-downloader 4.3.0 allows an attacker who can control the download URL to cause downloaded response data to be written outside the configured destination directory.

Affected

ProductAffectedFixed inSource
image-downloader< 4.3.14.3.1CNA

Scores by source

GitLab (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

refgitlab.com/demsking/image-downloader/-/work_items/32refgitlab.com/demsking/image-downloader/-/commit/fb4454304276e2439fb19b98836b3ba903b3aaea