Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-103648

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in image-downloader

Published
Last modified
Status
published
Known exploitation
Not listed in CISA KEV
Fix
Fixed in 4.3.1
Public exploit
None on Exploit-DB
CISA SSVC
  • Exploitation: none
  • Automatable: yes
  • Technical impact: partial
?

Decision points from CISA's Vulnrichment, assessed (SSVC 2.0.3).

SSVC documentation

Summary

Path traversal in image-downloader 4.3.0 allows an attacker who can control the download URL to cause downloaded response data to be written outside the configured destination directory.

Affected versions

  • demsking image-downloader

    fixed in 4.3.1

References 2

gitlab.com