THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-82635 (HIGH 8.8) — Pake before 3.13.1 joins the JavaScript-supplied filename for the download_file Tauri command onto the user's Downloads directory with no sanitization. A filename containing path traversal sequences (for example ../Library/LaunchAgents/com.evil.plist) or an absolute path resolves

[NVD] CVE-2026-82635 (HIGH 8.8) — Pake before 3.13.1 joins the JavaScript-supplied filename for the download_file Tauri command onto the user's Downloads directory with no sanitization. A filename containing path traversal sequences (for example ../Library/LaunchAgents/com.evil.plist) or an absolute path resolves

mednvdPublished 2026-08-30

CVE-2026-82635 CVSS: 8.8 HIGH Published: 2026-08-30T13:16:56.923

Pake before 3.13.1 joins the JavaScript-supplied filename for the download_file Tauri command onto the user's Downloads directory with no sanitization. A filename containing path traversal sequences (for example ../Library/LaunchAgents/com.evil.plist) or an absolute path resolves outside ~/Downloads. The command then fetches attacke

MITRE ATT&CK techniques

JavaScriptT1059.007

Indicators of compromise

CVE-2026-82635cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-82635