image-downloader CVE-2026-103648

Exploitation requires that the integrating application lets an attacker control the download URL (or derived output path) passed to image-downloader 4.3.0; the flaw lets crafted traversal sequences redirect the written response data outside the configured destination directory. Per CVSS PR:N/UI:N it needs no authentication or user interaction against the library itself, but the practical limiting factor is deployment: only applications that forward untrusted URLs to this library are exposed, and upgrading past 4.3.0 (fix commit fb44543) removes the condition. Impact is write-oriented (I:H/A:H, C:N) - file overwrite/corruption rather than data disclosure.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H, base 9.1) characterizes this as a network-reachable, low-complexity, unauthenticated path traversal (CWE-22) with high integrity and availability impact and no confidentiality impact - consistent with an attacker writing/overwriting arbitrary files but not reading them. No EPSS score, KEV listing, or public POC was supplied, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the 9.1 is therefore a theoretical-severity signal rather than a demonstrated-exploitation signal. A key caveat: the CVSS PR:N assumes the attacker directly controls the download URL, but image-downloader is a library - real exposure depends entirely on whether the consuming application passes attacker-influenced URLs/filenames to it, which the CVE data cannot confirm. The presence of a vendor fix commit (GitLab) indicates a patch exists and the issue is vendor-acknowledged. Net: treat as a genuine high-severity bug to patch promptly in any service that forwards untrusted URLs to this library, but with real-world risk heavily moderated by its niche library footprint and the absence of any exploitation evidence.

An application uses demsking/image-downloader 4.3.0 to fetch images from user-supplied URLs. An attacker supplies a URL whose response/path components include directory-traversal sequences, causing the downloaded response data to be written outside the configured destination directory - overwriting sensitive files (e.g., config, scripts, or web-accessible content) to corrupt data or potentially achieve code execution. No public exploit code was identified at time of analysis.