{"id":"CVE-2026-103648","published":"2026-10-02T16:16:44.370","lastModified":"2026-10-03T16:16:34.007","description":"Path traversal in image-downloader 4.3.0 allows an attacker who can control the download URL to cause downloaded response data to be written outside the configured destination directory.","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","cwes":["CWE-22"],"vendors":[],"products":[],"references":[{"url":"https://gitlab.com/demsking/image-downloader/-/commit/fb4454304276e2439fb19b98836b3ba903b3aaea","tags":[]},{"url":"https://gitlab.com/demsking/image-downloader/-/work_items/32","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The flaw allows an attacker to traverse paths and write response data outside the intended directory, potentially leading to unauthorized access or data corruption.","exploitability":"Exploitation is relatively straightforward for an attacker who can control the download URL, requiring minimal preconditions.","blast_radius":"If exploited, the impact could be significant, as it may lead to data leakage or corruption outside the intended directory structure.","remediation":"Upgrade to image-downloader 4.3.1 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["path-traversal","data-leakage","web"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-03T08:46:18.669Z"}}