CVE-2026-103648

CRITICAL9.1

Published 2026-10-02 · Updated 2026-10-03 · Source cve@gitlab.com

Description

Path traversal in image-downloader 4.3.0 allows an attacker who can control the download URL to cause downloaded response data to be written outside the configured destination directory.

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

CWE-22

References

View on NVD

Related CVEs

Same severity, most recent

CVE-2026-96207
Improper certificate validation in Microsoft Partner Center allows an unauthorized attacker to elevate privileges over a network.
2026-10-08 · score 10.0
CVE-2026-94510
Authorization bypass through user-controlled key in Microsoft Bookings allows an unauthorized attacker to elevate privileges over a network.
2026-10-08 · score 9.9
CVE-2026-88131
Deserialization of untrusted data in Microsoft Dataverse allows an unauthorized attacker to execute code over a network.
2026-10-08 · score 9.8
CVE-2026-77900
Missing authentication for critical function in Azure App Service allows an unauthorized attacker to execute code over a network.
2026-10-08 · score 9.8
CVE-2026-69435
Missing authorization in Azure SRE Agent allows an authorized attacker to elevate privileges over a network.
2026-10-08 · score 9.6