CVE-2026-105293

8.1 HIGHpublic exploit available

Published 2026-10-05 · Updated 2026-10-06

AI risk analysis

Summary: The flaw allows script in the Discord page to traverse paths and execute local commands, leading to potential local file system damage and unauthorized access.
Exploitability: Exploitation requires running script in the Discord origin, such as through XSS, making it moderately difficult to exploit.
Blast radius: If exploited, attackers could gain significant control over the affected system, including executing arbitrary code and deleting files.
Detection: No reliable host or network indicator is derivable from the published description.
Prioritized remediation: Upgrade to Legcord 1.4.0 or later.

rcewebxsspath-traversal

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

Legcord 1.1.0 through 1.3.0 contains a path traversal vulnerability in theme IPC handlers that allows script in the Discord page to escape the themes directory via unvalidated theme ids. Attackers running script in the Discord origin, such as through XSS, can abuse themes.folder, themes.uninstall, and themes.install to launch local executables, recursively delete directories, and write files outside the themes directory.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-22

Public exploit & PoC references

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.