EUVD-2026-49255
GHSA-5xhx-w5wq-c68v
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible, no authentication or user interaction required; only integrity impact on the host.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
NitroShare Desktop through 0.3.4 contains a path traversal vulnerability in its LAN file transfer server that allows unauthenticated attackers on the same network to write arbitrary files by sending a crafted filename containing directory traversal sequences in the JSON item header name field. Attackers can exploit the lack of path validation to write files outside the transfer root directory to arbitrary locations the current user has write access, including the Windows Startup folder, enabling persistent code execution on the next user login.
AnalysisAI
Arbitrary file write in NitroShare Desktop 0.3.4 allows unauthenticated attackers on the same network to plant malicious files on a target system by sending a crafted filename with directory traversal sequences in the JSON item header name field. The vulnerability can be exploited to write to the Windows Startup folder, achieving persistent code execution when the user next logs in. Publicly available exploit code exists but it is not listed in CISA KEV.
Technical ContextAI
The vulnerability exists in NitroShare Desktop's LAN file transfer server, which accepts JSON-formatted transfer requests containing a filename field. Due to CWE-22 (improper path validation), an attacker can inject directory traversal sequences (e.g., '../') into the 'name' attribute of the JSON item header, causing files to be written outside the designated transfer root directory. The affected product is identified by cpe:2.3:a:nitroshare:nitroshare-desktop:*:*:*:*:*:*:*:*.
RemediationAI
No official vendor patch is available. Disable the LAN file transfer server in NitroShare settings, or block the service's default TCP port 4080 at the host firewall. Monitor user-writable paths such as the Windows Startup folder for unexpected files. If the server must remain active, restrict network access to trusted hosts only. Once a patched version is released, apply it immediately; refer to the VulnCheck advisory for updates.
Same weakness CWE-22 – Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today