CVE-2026-103398

Summary

The flaw allows attackers to read and write files in arbitrary directories outside the configured save locations by manipulating save paths in the manifest request handler, posing a significant security risk.

Exploitability

Exploitation is relatively straightforward given the preconditions of paired peers and the ability to specify arbitrary directories. Attackers must have access to the paired peer's manifest request handler.

Blast radius

If exploited, this vulnerability could lead to unauthorized access and manipulation of sensitive files across the network, with potential for data theft or corruption.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to OpenSave version 2.4.1 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.