CVE-2026-103648

CVSS 9.1 (critical) · published 2026-10-02

Path traversal in image-downloader 4.3.0 allows an attacker who can control the download URL to cause downloaded response data to be written outside the configured destination directory.

Weakness: CWE-22

Source: NVD CVE-2026-103648

References

• https://gitlab.com/demsking/image-downloader/-/commit/fb4454304276e2439fb19b98836b3ba903b3aaea
• https://gitlab.com/demsking/image-downloader/-/work_items/32

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.