EUVD-2026-43271
GHSA-2gq8-477v-cpgh
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local access with low privileges required to supply the icons_file argument; unchanged scope and limited CIA impact align with the CVSS 4.0 source vector.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability has been found in better-auth better-icons up to 1.0.5. This vulnerability affects unknown code of the component scan_project_icons/sync_icon. Such manipulation of the argument icons_file leads to path traversal. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Path traversal in better-auth/better-icons (versions up to and including 1.0.5) allows a local low-privileged attacker to manipulate the icons_file argument passed to the scan_project_icons/sync_icon component, escaping the intended directory boundary to read or write arbitrary files accessible to the process. A public proof-of-concept has been disclosed via GitHub issue #18, and the vendor has not yet responded to the responsible disclosure. No CISA KEV listing exists; the CVSS 4.0 base score of 1.9 correctly reflects the constrained local-only attack surface and limited per-file impact.
Technical ContextAI
CWE-22 (Improper Limitation of a Pathname to a Restricted Directory - 'Path Traversal') describes the root cause: the icons_file parameter accepted by scan_project_icons and sync_icon is not sanitized for directory traversal sequences (e.g., '../') before being used in filesystem operations. The affected package is cpe:2.3:a:better-auth:better-icons:*:*:*:*:*:*:*:*, an icon management utility within the better-auth ecosystem. Because no CPE version floor is specified, all releases up through 1.0.5 are confirmed in scope. The flaw exists in the icon synchronization logic, which reads or writes icon files based on caller-supplied paths, and fails to canonicalize or jail those paths to a safe base directory before use.
RemediationAI
No vendor-released patch has been identified at the time of analysis; the vendor has not responded to the disclosure per the CVE description. As a compensating control, restrict execution of scan_project_icons and sync_icon operations to trusted users only, ensuring that untrusted or low-privileged accounts cannot supply the icons_file argument - this eliminates the attack path but may limit pipeline functionality. Additionally, deploy filesystem-level controls (e.g., chroot, container namespaces, or AppArmor/SELinux profiles) around the process executing these icon operations to limit the files reachable via traversal, at the cost of added operational complexity. Monitor the GitHub repository at https://github.com/better-auth/better-icons/ for a patched release and apply it as soon as one is available. Reference the public exploit at https://github.com/better-auth/better-icons/issues/18 to validate whether proposed mitigations adequately address the specific traversal vector disclosed.
More in Better Auth
View allBetter Auth is an authentication library for TypeScript. Rated high severity (CVSS 7.9), this vulnerability is remotely
Authorization bypass in the @better-auth/oauth-provider plugin for Better Auth (versions >= 1.4.8-beta.7 and < 1.6.5, pl
Privilege-escalating account takeover in the @better-auth/scim plugin (versions 1.4.0-beta.27 through 1.6.21 and 1.7.0-b
Authentication bypass in Better Auth before 1.6.11 stems from insecure cryptographic defaults in the legacy oidcProvider
Denial of service in Better Auth (npm) before 1.4.2 lets an unauthenticated remote attacker poison the router's base pat
Path normalization bypass in Better Auth before v1.4.5 allows unauthenticated remote attackers to circumvent `disabledPa
Authorization bypass in @better-auth/scim versions 1.5.0 through 1.7.0-beta.3 allows any authenticated user to fully tak
Pre-account hijacking in better-auth (npm) allows a remote attacker to gain persistent, password-based access to any vic
Multiple authentication bypass vulnerabilities in @better-auth/sso before version 1.6.21 enable low-privileged attackers
Two domain-ownership authentication bypass flaws in @better-auth/sso allow authenticated organization owners to compromi
Two-factor authentication bypass in better-auth (npm) before version 1.4.9 allows network-accessible attackers holding v
Privilege escalation in Better Auth SSO plugin (1.2.10 to <1.6.11) allows any authenticated organization member to regis
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today