EUVD-2026-68199
GHSA-9r73-w272-42v3
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-delivered via WebView content (AV:N), no attacker credentials required (PR:N), but user must run the app and load attacker content (UI:R); full file write capability justifies High C/I/A.
Primary rating from Vendor (JFROG).
CVSS VectorVendor: JFROG
Lifecycle Timeline
3DescriptionCVE.org
Pake before 3.13.1 joins the JavaScript-supplied filename for the download_file Tauri command onto the user's Downloads directory with no sanitization. A filename containing path traversal sequences (for example ../Library/LaunchAgents/com.evil.plist) or an absolute path resolves outside ~/Downloads. The command then fetches attacker-controlled content from the supplied URL (via Rust HTTP, not the browser) and writes it to that path. A script that can invoke the command can overwrite user-writable files and install persistence (macOS LaunchAgents, Linux autostart, Windows Startup), leading to code execution in the user account. All desktop apps generated from an affected Pake tree expose the same command.
AnalysisAI
Path traversal in Pake before 3.13.1 allows a malicious or compromised web page loaded inside any Pake-generated desktop app to write attacker-fetched content to arbitrary user-writable filesystem locations, including persistence directories. The download_file Tauri command accepted a JavaScript-supplied filename and joined it directly to the Downloads directory without stripping path separators or sanitizing sequences such as ../, enabling writes to locations such as ~/Library/LaunchAgents/ on macOS, ~/.config/autostart/ on Linux, or the Windows Startup folder. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the victim is actively running a desktop application built with an affected version of Pake (before 3.13.1) and that attacker-controlled JavaScript can be executed within that application's WebView - either because the app loads external URLs, allows in-app navigation to arbitrary sites, or the wrapped origin itself serves attacker content. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) is internally consistent with the described attack: network-delivered malicious content reaches the victim through the Pake WebView, no attacker credentials are required, and the user only needs to run the app and load attacker-controlled content. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Pake 3.13.1 or later, available at https://github.com/tw93/Pake/releases/tag/V3.13.1, which introduces `sanitize_download_filename` to strip all path components from the caller-supplied filename before joining it to the Downloads directory. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-22 – Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today