{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aimage-downloader_projectimage-downloadernode.js/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:image-downloader_project:image-downloader:*:*:*:*:*:node.js:*:*"],"_cs_cves":[{"cvss":9.1,"id":"CVE-2026-103648"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["image-downloader (\u003c 4.3.1)"],"_cs_severities":["critical"],"_cs_tags":["vulnerability","path-traversal","npm","rce"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eCVE-2026-103648 is a critical path traversal vulnerability in the 'image-downloader' npm package. The vulnerability exists due to incorrect ordering of filename processing: the library calls \u003ccode\u003epath.basename()\u003c/code\u003e on a URL path before \u003ccode\u003edecodeURIComponent()\u003c/code\u003e. An attacker can supply a percent-encoded path traversal sequence (e.g., \u003ccode\u003e%2e%2e%2f\u003c/code\u003e) that bypasses the basename check, only to be decoded into a functional \u003ccode\u003e../\u003c/code\u003e sequence during path construction. This results in the application writing files outside the intended destination directory.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies a target application using \u003ccode\u003eimage-downloader\u003c/code\u003e that accepts user-supplied URLs for image processing.\u003c/li\u003e\n\u003cli\u003eAttacker hosts a malicious server or redirects a request to a controlled URL path.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a URL path containing percent-encoded traversal sequences (e.g., \u003ccode\u003e/%2e%2e%2f%2e%2e%2fetc/passwd\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe vulnerable \u003ccode\u003eimage-downloader\u003c/code\u003e package calls \u003ccode\u003epath.basename()\u003c/code\u003e on the encoded path, which fails to strip the traversal sequences because they contain no literal slashes.\u003c/li\u003e\n\u003cli\u003eThe library calls \u003ccode\u003edecodeURIComponent()\u003c/code\u003e, resolving the percent-encoded sequences into literal \u003ccode\u003e../\u003c/code\u003e traversal strings.\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003epath.join()\u003c/code\u003e concatenates the destination directory and the decoded traversal, resulting in a write operation outside the restricted directory.\u003c/li\u003e\n\u003cli\u003eThe application writes the content from the attacker-controlled URL to the chosen target path on the host filesystem.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for arbitrary file writes on the host system. Depending on the environment and filesystem permissions, this can lead to remote code execution by overwriting configuration files, startup scripts, or authentication-related files such as \u003ccode\u003e.ssh/authorized_keys\u003c/code\u003e.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade \u003ccode\u003eimage-downloader\u003c/code\u003e to version 4.3.1 or later immediately.\u003c/li\u003e\n\u003cli\u003eAudit applications utilizing the \u003ccode\u003eimage-downloader\u003c/code\u003e library to ensure that user-supplied URLs are strictly validated or passed through a blocklist of traversal characters before processing.\u003c/li\u003e\n\u003cli\u003eImplement filesystem sandboxing or run processes with the principle of least privilege to limit the impact of potential arbitrary file write vulnerabilities.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-23T16:37:25Z","date_published":"2026-10-23T16:37:25Z","id":"https://feed.craftedsignal.io/briefs/2026-10-cve-2026-103648-image-downloader/","summary":"A critical path traversal vulnerability in the npm package image-downloader allows attackers to perform arbitrary file writes by providing a specially crafted percent-encoded URL.","title":"image-downloader: Path traversal arbitrary file write (CVE-2026-103648)","url":"https://feed.craftedsignal.io/briefs/2026-10-cve-2026-103648-image-downloader/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:image-Downloader_project:image-Downloader:*:*:*:*:*:node.js:*:*","version":"https://jsonfeed.org/version/1.1"}