CVE-2026-103648

Summary

The flaw allows an attacker to traverse paths and write response data outside the intended directory, potentially leading to unauthorized access or data corruption.

Exploitability

Exploitation is relatively straightforward for an attacker who can control the download URL, requiring minimal preconditions.

Blast radius

If exploited, the impact could be significant, as it may lead to data leakage or corruption outside the intended directory structure.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to image-downloader 4.3.1 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.