Skip to content
CVE PROGRAM SOURCE RECORD9.1 Critical

CVE-2026-103648

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in image-downloader

Description

Path traversal in image-downloader 4.3.0 allows an attacker who can control the download URL to cause downloaded response data to be written outside the configured destination directory.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

demsking image-downloader

Default version status: unknown

  • 0 to < 4.3.1affected

References