EUVD-2026-87130
GHSA-m68w-q97c-3w3j
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Input Leap peer with drag-drop enabled
-
DeliverySend crafted DDRG message
-
ExploitAbuse / vs \ path traversal
-
ExecutionWrite file to startup directory
-
ImpactCode executes at next login
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Leading special element handling
|
| Exploitation Conditions | Requires the non-default |
| Impact | This is a high-CVSS-ceiling-but-low-real-risk issue in practice. The provided CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N, base 5.3) already tempers severity via AC:H and the constrained impact, and I concur the practical priority is modest. Key gating signals: exploitation requires the NON-DEFAULT |
| Exploit ScenarioDerived | An attacker who can present as a connected Input Leap peer (or intercept/inject on the connection) to a victim running the non-default |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 25, 2026
Directory traversal in Input Leap through 3.0.3 allows a connected peer to send a crafted DDRG drag-and-drop protocol message that escapes the intended drop directory on Windows and macOS, writing attacker-controlled files anywhere the Input Leap process has write access - including startup directories, which yields code execution the next time the victim logs in or reboots. The flaw only manifests when the non-default --enable-drag-drop option is explicitly enabled and only against Windows or macOS targets; delivery requires the attacker to act as an authorized/connected peer (PR:L per the assessed vector, which the vendor vector agrees on). No public exploit code or confirmed active exploitation was identified at time of analysis, and while the vendor score is 5.3 (C:N/I:H/A:N), our independent assessment raises the impact ceiling to C:H/I:H/A:H - this is a high-ceiling but low-risk-in-practice issue because of the non-default prerequisite, the platform restriction, and the delayed, login-dependent execution path.
RemediationAI
No vendor-released fixed version is identified in the available data, so the primary action is to eliminate the vulnerable configuration: remove the non-default --enable-drag-drop option from the Input Leap client and server command lines (or from the service/launch configuration) on all Windows and macOS peers, then restart the peer - this completely removes the DDRG message handling path and is the highest-confidence mitigation, at the cost of losing drag-and-drop file transfer between machines. Administrators should monitor https://github.com/input-leap/input-leap/releases and the project advisories for a patched release and upgrade as soon as one is published. As compensating controls, restrict which hosts can connect to the Input Leap peer: require TLS and password authentication via SecureSocket and limit accepted peers to known, trusted machines, which raises the PR:L prerequisite to a trusted-user requirement but does not help if any authorized peer is itself compromised. Run the Input Leap process under a least-privileged account whose writable locations exclude per-user startup directories, accepting that this is hard to guarantee on Windows/macOS since user profile startup folders are typically writable by that user. Finally, block the configured Input Leap listening port from untrusted network segments and avoid exposing the peer directly to the internet; the trade-off is reduced flexibility for remote or multi-network use. Related advisories for the Deskflow fork and the historical Barrier issue CVE-2021-42072 are worth reviewing for additional hardening guidance.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-180 (Incorrect Behavior Order: Validate Before Canonicalize). Input Leap is the community fork of Barrier/Synergy, a KVM-style remote input sharing tool where a client and server exchange input events, clipboard data, and optional drag-and-drop file transfers over an authenticated socket (see SecureSocket.cpp). When the non-default --enable-drag-drop option is active, the peer parses DDRG drag-and-drop messages in src/lib/inputleap/DragInformation.cpp and resolves the drop target in src/lib/inputleap/DropHelper.cpp. On Windows and macOS the backslash and forward slash are both treated as path separators, but the traversal validation is applied before the path is canonicalized, so a filename constructed with the alternate separator convention bypasses the '..' checks and is then resolved by the OS as a genuine parent-directory reference. Because the same handler writes the received file to the resolved location, the attacker can drop content into a per-user startup directory (for example the Windows Startup folder or a macOS LoginItems/LaunchAgents-adjacent path) and obtain code execution at next login. The affected product is identified by CPE cpe:2.3:a:input-leap:input_leap:*:*:*:*:*:*:*:* (a wildcard range; the description bounds affected releases at 3.0.3). This bug is closely related to the Barrier drag-and-drop traversal CVE-2021-42072 cited in the references, and to advisories published for the related Deskflow project, indicating a shared lineage of drag-and-drop path-handling defects across these forks. The references to ArgParser.cpp and Server.cpp document how the --enable-drag-drop flag and server-side message handling are configured. Real-world risk is bounded by the assessed constraints: AV:N/AC:H/PR:L/UI:N/S:U with C:H/I:H/A:H, i.e. network-reachable but requiring an authenticated/authorized peer relationship and a non-default feature toggle, and the exploit requires the victim to log in or reboot before payload execution.
Know when Input Leap gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
Non-default option plus specific path/message crafting gives AC:H; a connected peer implies PR:L; resultant startup-dir code execution runs in the user context, so C/I/A:H rather than integrity-only.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
DescriptionCVE.org
Input Leap (aka input-leap) through 3.0.3, when the non-default --enable-drag-drop option is used on Windows or macOS, mishandles the / versus \ distinction and allows directory traversal, with resultant code execution if a file is written to a startup directory. This occurs via a DDRG message.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB