CVE-2026-103648

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in image-downloader

Path traversal in image-downloader 4.3.0 allows an attacker who can control the download URL to cause downloaded response data to be written outside the configured destination directory.

Affected

demsking · image-downloader

CVSS v3.1 GITLAB

9.1 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

EPSS

0.41% chance of exploitation in the next 30 days, 34th percentile

Published

2026-10-02

Updated

2026-10-03

Proof-of-concept exploits (1)

• EterNullSec/CVE-2026-1036482★ · 2026-10-06

References

• CVE Record
• NVD entry