CVE-2026-105293

HighCVSS 8.1/10Last modified Oct 6, 2026

Description

Legcord 1.1.0 through 1.3.0 contains a path traversal vulnerability in theme IPC handlers that allows script in the Discord page to escape the themes directory via unvalidated theme ids. Attackers running script in the Discord origin, such as through XSS, can abuse themes.folder, themes.uninstall, and themes.install to launch local executables, recursively delete directories, and write files outside the themes directory.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Oct 5, 2026
Last modified: Oct 6, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1052947.4Legcord 1.1.0 through 1.3.0 contains a configuration injection vulnerability that allows script in the Discord page to write any config key CVE-2026-1052957.5GitAhead 2.5.0 through 2.7.1 contains an insecure update mechanism that installs downloaded updates without integrity or signature verificat CVE-2026-1052977.5Summary Before version 0.8.1, Pingora's HTTP/2 server used the h2 crate's default limits unless the application set its own 16 MiB decode CVE-2026-1052986.3Summary Before version 0.9.0, Pingora accepted HTTP/2 requests whose Host header differed from the :authority pseudo-header. Request filt CVE-2026-1052998.7Summary Before version 0.9.0, the HTTP/1 upstream path in pingora-proxy passed the downstream request through upstream_request_filter and CVE-2026-10534.4The Ivory Search – WordPress Search Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versi CVE-2026-105305.3The Pie Register WordPress plugin before 3.8.4.10 does not use sufficiently random values when generating its account verification tokens, CVE-2026-1053025.7A flaw was found in the User Session Note mapper of the Keycloak identity and access management solution. The issue occurs because the mappe CVE-2026-1053055.4A flaw was found in the OIDC implementation of Keycloak, specifically within the Device Authorization Grant flow. This component allows devi CVE-2026-1053066.5A flaw was found in the Dynamic Client Registration flow of the Keycloak identity and access management server. The issue occurs because the CVE-2026-1053077.3A vulnerability was detected in Casdoor up to 3.161.1. Affected is the function ApiFilter of the file routers/authz_filter.go of the compone CVE-2026-105315.4The AI Share & Summarize WordPress plugin before 2.0.4 does not sanitise and escape some of its shortcode attributes before outputting them