What is the CVSS score of CVE-2026-22685?

CVE-2026-22685 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Devtoys are affected by CVE-2026-22685?

Organizations using versions from 2.0.0.0 to face significant risk from CVE-2026-22685, a path traversal vulnerability rated CVSS 8.8.. A patch is available.

How to fix or mitigate CVE-2026-22685?

Within 7 days: Identify all affected systems running versions from 2.0.0.0 to and apply vendor patches promptly. Review file handling controls and restrict upload directories.

Devtoys CVE-2026-22685

HIGH

Path Traversal (CWE-22)

2026-01-10 security-advisories@github.com

Path Traversal Devtoys

8.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

Patch released

Mar 12, 2026 - 19:20 nvd

Patch available

CVE Published

Jan 10, 2026 - 06:15 nvd

HIGH 8.8

DescriptionGitHub Advisory

DevToys is a desktop app for developers. In versions from 2.0.0.0 to before 2.0.9.0, a path traversal vulnerability exists in the DevToys extension installation mechanism. When processing extension packages (NUPKG archives), DevToys does not sufficiently validate file paths contained within the archive. A malicious extension package could include crafted file entries such as ../../…/target-file, causing the extraction process to write files outside the intended extensions directory. This flaw enables an attacker to overwrite arbitrary files on the user’s system with the privileges of the DevToys process. Depending on the environment, this may lead to code execution, configuration tampering, or corruption of application or system files. This issue has been patched in version 2.0.9.0.

AnalysisAI

DevToys versions 2.0.0.0 through 2.0.8.x are vulnerable to path traversal attacks during extension package installation, allowing attackers to write files outside the intended directory by crafting malicious NUPKG archives with directory traversal sequences. An attacker can exploit this to overwrite arbitrary files with DevToys process privileges, potentially enabling code execution or system compromise on affected systems. The vulnerability is patched in version 2.0.9.0.

Technical ContextAI

Classified as CWE-22 (Path Traversal). Affects Devtoys. DevToys is a desktop app for developers. In versions from 2.0.0.0 to before 2.0.9.0, a path traversal vulnerability exists in the DevToys extension installation mechanism. When processing extension packages (NUPKG archives), DevToys does not sufficiently validate file paths contained within the archive. A malicious extension package could include crafted file entries such as ../../…/target-file, causing the extraction process to write files outside the intended extensions directory. This flaw en

RemediationAI

A vendor patch is available — apply it immediately. Fixed in version 2.0.9.0.. Validate and sanitize file path inputs. Use allowlists. Restrict network access to the affected service where possible.