CVE-2026-103648

CriticalCVSS 9.1/10Last modified Oct 3, 2026

Description

Path traversal in image-downloader 4.3.0 allows an attacker who can control the download URL to cause downloaded response data to be written outside the configured destination directory.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-22

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Oct 2, 2026
Last modified
Oct 3, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1036497.5Missing network timeouts in the Linux builds of Progressive Robot hMailServer 6.3.0 through 6.3.5 allow a remote attacker to hold server thrCVE-2026-1036517.6MISP contains a vulnerability in its one-time password (OTP) authentication flow that allows replay of a consumed HOTP (paper) token and rewCVE-2026-1036559.3MISP contains a vulnerability in its two-factor authentication (TOTP) verification process that permits a valid one-time code to be acceptedCVE-2026-1036585.9GNU Aspell 0.60.8.2 (first vulnerable version is not known) contains a heap-based buffer overflow write (CWE-122) in its read-only dictionarCVE-2026-1036597.1MISP contains an authorization bypass in the event flattening feature. When a user requests an event with the flatten option enabled, the apCVE-2026-1036625.1MISP contains a reflected cross-site scripting (XSS) vulnerability in the legacy taxonomy tag management confirmation forms (add tag and disCVE-2026-1036639.4Ollama is vulnerable to path traversal in the `/api/pull` endpoint due to insufficient validation of layer digests by the `digestToPath` funCVE-2026-1036644.8MISP contains a reflected cross-site scripting (XSS) vulnerability in the analyst data notes panel. The seed path parameter, supplied by theCVE-2026-1036675.4Gitea's container registry served blob downloads with a `Content-Type` taken from the media type declared in pushed image manifests, withoutCVE-2026-1036688.8An SQL Injection vulnerability exists in the Site Search function of Movable Type, which may allow an unauthenticated attacker to execute anCVE-2026-1036707.5When a Gitea Actions run was inserted, older runs in the same workflow-level concurrency group were cancelled without checking whether the nCVE-2026-1036715.3External control of assumed-Immutable web parameter issue exists in EC-CUBE plugin (for EC-CUBE 4 series) "AmazonPay Plugin". If exploited,