CVE-2026-22685
Path Traversal in DevToys Extension Installer Allows Arbitrary File Overwrite
Publication date: 2026-01-10
Last updated on: 2026-03-12
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| devtoys | devtoys | From 2.0.1.0 (inc) to 2.0.9.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-22685 is a critical path traversal vulnerability in the DevToys extension installation mechanism affecting versions 2.0.0.0 through 2.0.8.0. When DevToys processes extension packages (NUPKG archives), it does not properly validate file paths inside the archive. Malicious packages can include crafted file paths with sequences like ../../ that cause files to be extracted outside the intended extensions directory. This allows an attacker to overwrite arbitrary files on the user's system with the privileges of the DevToys process, potentially leading to code execution, configuration tampering, or corruption of application or system files. The vulnerability is known as a "Zip Slip" attack and was patched in version 2.0.9.0. [1]
How can this vulnerability impact me? :
This vulnerability can allow an attacker to overwrite arbitrary files on your system with the privileges of the DevToys process. This could lead to dropping executable payloads, modifying configuration files, corrupting application or system files, and potentially executing arbitrary code depending on your environment and system context. The impact includes high confidentiality, integrity, and availability risks. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves path traversal during the extraction of DevToys extension packages (NUPKG archives). Detection can focus on monitoring for suspicious file extraction activities outside the intended extensions directory, especially files with path traversal patterns like '../../'. You can inspect recently extracted extension files for unexpected file paths or check logs for critical security violation entries referencing extension IDs. Since the vulnerability exploits crafted archive entries, scanning installed extension packages for entries containing '../' sequences can help detect attempts. Specific commands are not provided in the resources, but general approaches include searching extracted extension directories for files outside expected paths and reviewing DevToys logs for installation errors or security violation messages. [1, 3]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include: 1) Updating DevToys to version 2.0.9.0 or later, where the vulnerability is patched. 2) Avoid installing untrusted or third-party extensions until the update is applied. 3) Alternatively, roll back to DevToys version 1.* if updating is not immediately possible. These steps prevent exploitation by ensuring the extension installation mechanism properly validates file paths and blocks path traversal attempts. [1]