CVE-2026-82635

Pake before 3.13.1 joins the JavaScript-supplied filename for the download_file Tauri command onto the user's Downloads directory with no sanitization. A filename containing path traversal sequences (for example ../Library/LaunchAgents/com.evil.plist) or an absolute path resolves outside ~/Downloads. The command then fetches attacker-controlled content from the supplied URL (via Rust HTTP, not the browser) and writes it to that path. A script that can invoke the command can overwrite user-writable files and install persistence (macOS LaunchAgents, Linux autostart, Windows Startup), leading to code execution in the user account. All desktop apps generated from an affected Pake tree expose the same command.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/tw93/Pake	Product
https://github.com/tw93/Pake/commit/a5463a84d6e36705ee0dd1886cf0e4b5a75b0ab4	Patch Vendor Advisory
https://github.com/tw93/Pake/releases/tag/V3.13.1	Release Notes

Configurations

Configuration 1 (hide)

cpe:2.3:a:faberon:pake:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-08-30 13:16

Updated : 2026-09-04 20:32

NVD link : CVE-2026-82635

Mitre link : CVE-2026-82635

CVE.ORG link : CVE-2026-82635

JSON object : View

Products Affected

faberon

pake

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2026-82635", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-82635", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-31T16:58:34.725075Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "reefs@jfrog.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "affected": [{"source": "reefs@jfrog.com", "affectedData": [{"repo": "git://github.com/tw93/Pake", "vendor": "tw93", "modules": ["download_file"], "product": "Pake", "versions": [{"status": "affected", "version": "0", "lessThan": "3.13.1", "versionType": "semver"}], "programFiles": ["src-tauri/src/app/invoke.rs", "src-tauri/src/util.rs"], "collectionURL": "https://github.com/tw93/Pake", "defaultStatus": "unaffected"}]}], "published": "2026-08-30T13:16:56.923", "references": [{"url": "https://github.com/tw93/Pake", "tags": ["Product"], "source": "reefs@jfrog.com"}, {"url": "https://github.com/tw93/Pake/commit/a5463a84d6e36705ee0dd1886cf0e4b5a75b0ab4", "tags": ["Patch", "Vendor Advisory"], "source": "reefs@jfrog.com"}, {"url": "https://github.com/tw93/Pake/releases/tag/V3.13.1", "tags": ["Release Notes"], "source": "reefs@jfrog.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "reefs@jfrog.com", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "Pake before 3.13.1 joins the JavaScript-supplied filename for the download_file Tauri command onto the user's Downloads directory with no sanitization. A filename containing path traversal sequences (for example ../Library/LaunchAgents/com.evil.plist) or an absolute path resolves outside ~/Downloads. The command then fetches attacker-controlled content from the supplied URL (via Rust HTTP, not the browser) and writes it to that path. A script that can invoke the command can overwrite user-writable files and install persistence (macOS LaunchAgents, Linux autostart, Windows Startup), leading to code execution in the user account. All desktop apps generated from an affected Pake tree expose the same command."}], "lastModified": "2026-09-04T20:32:15.300", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:faberon:pake:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0F6E5D99-45A7-4CBE-94D1-610AD90ABC8F", "versionEndExcluding": "3.13.1"}], "operator": "OR"}]}], "sourceIdentifier": "reefs@jfrog.com"}