Image Downloader
Monthly
Path traversal (CWE-22) in image-downloader 4.3.0 allows an attacker who controls the download URL to write response data outside the configured destination directory, resulting in arbitrary file overwrite or corruption (CVSS 9.1, I:H/A:H, C:N). Per the CVSS vector, the flaw is network-reachable, low-complexity, unauthenticated, and requires no user interaction against the library, but exploitation is limited to applications that forward untrusted URLs to it. No public exploit code or active exploitation (CISA KEV) has been identified, and an upstream fix commit (fb44543) is available.
Path traversal (CWE-22) in image-downloader 4.3.0 allows an attacker who controls the download URL to write response data outside the configured destination directory, resulting in arbitrary file overwrite or corruption (CVSS 9.1, I:H/A:H, C:N). Per the CVSS vector, the flaw is network-reachable, low-complexity, unauthenticated, and requires no user interaction against the library, but exploitation is limited to applications that forward untrusted URLs to it. No public exploit code or active exploitation (CISA KEV) has been identified, and an upstream fix commit (fb44543) is available.