CVE-2026-103648 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in image-downloader

CVE-2026-103648

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in image-downloader PUBLISHED

Description (CNA)

Path traversal in image-downloader 4.3.0 allows an attacker who can control the download URL to cause downloaded response data to be written outside the configured destination directory.

Affected (CNA)

Vendor / product	Versions
demsking / image-downloader	affected 0 before 4.3.1

CWE

CWE-22

References

https://gitlab.com/demsking/image-downloader/-/work_items/32
https://gitlab.com/demsking/image-downloader/-/commit/fb4454304276e2439fb19b98836b3ba903b3aaea

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.