Input Leap
Monthly
Directory traversal in Input Leap through 3.0.3 allows a connected peer to send a crafted DDRG drag-and-drop protocol message that escapes the intended drop directory on Windows and macOS, writing attacker-controlled files anywhere the Input Leap process has write access - including startup directories, which yields code execution the next time the victim logs in or reboots. The flaw only manifests when the non-default --enable-drag-drop option is explicitly enabled and only against Windows or macOS targets; delivery requires the attacker to act as an authorized/connected peer (PR:L per the assessed vector, which the vendor vector agrees on). No public exploit code or confirmed active exploitation was identified at time of analysis, and while the vendor score is 5.3 (C:N/I:H/A:N), our independent assessment raises the impact ceiling to C:H/I:H/A:H - this is a high-ceiling but low-risk-in-practice issue because of the non-default prerequisite, the platform restriction, and the delayed, login-dependent execution path.
Directory traversal in Input Leap through 3.0.3 allows a connected peer to send a crafted DDRG drag-and-drop protocol message that escapes the intended drop directory on Windows and macOS, writing attacker-controlled files anywhere the Input Leap process has write access - including startup directories, which yields code execution the next time the victim logs in or reboots. The flaw only manifests when the non-default --enable-drag-drop option is explicitly enabled and only against Windows or macOS targets; delivery requires the attacker to act as an authorized/connected peer (PR:L per the assessed vector, which the vendor vector agrees on). No public exploit code or confirmed active exploitation was identified at time of analysis, and while the vendor score is 5.3 (C:N/I:H/A:N), our independent assessment raises the impact ceiling to C:H/I:H/A:H - this is a high-ceiling but low-risk-in-practice issue because of the non-default prerequisite, the platform restriction, and the delayed, login-dependent execution path.