EUVD-2026-31704
GHSA-2wcg-qvrr-vf6j
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
A flaw has been found in dazeb markdown-downloader up to 3d4394b34b6c99d81af817623af55e3384df5a6a. Affected is the function download_markdown/list_downloaded_files/create_subdirectory of the file src/index.ts. Executing a manipulation can lead to path traversal. The attack can be launched remotely. The exploit has been published and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Path traversal in dazeb markdown-downloader exposes server-side file systems to low-privileged remote attackers through unsanitized input in three functions within src/index.ts. The affected functions - download_markdown, list_downloaded_files, and create_subdirectory - fail to restrict directory scope, allowing authenticated users with low privileges to read or write files outside intended boundaries. No public exploit identified at time of analysis as a KEV entry, but publicly available exploit code exists via a GitHub issue report, and the project maintainer has not acknowledged or patched the disclosure.
Technical ContextAI
markdown-downloader is a Node.js/TypeScript tool (src/index.ts) for fetching and storing markdown content. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), a classic path traversal flaw where user-controlled input is passed to file system operations without adequate canonicalization or prefix enforcement. The three affected functions - download_markdown, list_downloaded_files, and create_subdirectory - each perform file system operations that can be manipulated using sequences such as '../' to escape the intended working directory. The CPE identifier cpe:2.3:a:dazeb:markdown-downloader:*:*:*:*:*:*:*:* covers all releases, and because the project does not use semantic versioning, the affected codebase is pinned to commit 3d4394b34b6c99d81af817623af55e3384df5a6a as the last known vulnerable state. The CVSS 4.0 vector AV:N/AC:L/AT:N confirms network reachability with low attack complexity and no additional prerequisites beyond low-privilege authentication.
RemediationAI
No vendor-released patch has been identified at time of analysis. The project maintainer was notified via GitHub issue but has not responded. Users should consider forking the repository and applying manual input sanitization to the download_markdown, list_downloaded_files, and create_subdirectory functions in src/index.ts - specifically, resolving user-supplied paths with Node.js path.resolve() and asserting that the resolved path begins with the intended base directory before any file system operation is performed; failure to do so may allow '../' traversal to escape scope. As a compensating control, restrict application-level access to only trusted, authenticated users and run the process under a least-privilege OS account with a chroot or containerized file system boundary, so that even a successful traversal cannot reach sensitive host paths. Disabling the create_subdirectory feature entirely reduces attack surface if subdirectory creation is not required. Monitor the upstream repository at https://github.com/dazeb/markdown-downloader/ for any patching activity. The VulDB advisory at https://vuldb.com/vuln/365453 should be tracked for updates.
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today