CVE-2026-82635
Received Received - Intake

Path Traversal in Pake Desktop App

Publication date: 2026-08-30

Last updated on: 2026-08-30

Assigner: JFrog

Description
Pake before 3.13.1 joins the JavaScript-supplied filename for the download_file Tauri command onto the user's Downloads directory with no sanitization. A filename containing path traversal sequences (for example ../Library/LaunchAgents/com.evil.plist) or an absolute path resolves outside ~/Downloads. The command then fetches attacker-controlled content from the supplied URL (via Rust HTTP, not the browser) and writes it to that path. A script that can invoke the command can overwrite user-writable files and install persistence (macOS LaunchAgents, Linux autostart, Windows Startup), leading to code execution in the user account. All desktop apps generated from an affected Pake tree expose the same command.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-30
Last Modified
2026-08-30
Generated
2026-08-30
AI Q&A
2026-08-30
EPSS Evaluated
N/A
NVD
CVE-2026-82635
EUVD
EUVD-2026-68199

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
tw93 pake to 3.13.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Pake before 3.13.1 allows a malicious script to manipulate the download_file command by supplying a filename with path traversal sequences like ../ or absolute paths. This bypasses the intended Downloads directory and writes files to arbitrary locations on the system. The command then fetches attacker-controlled content and writes it to the specified path, enabling file overwrites and potential code execution via persistence mechanisms like macOS LaunchAgents or Windows Startup folders.

Detection Guidance

Check for suspicious files in Downloads, autostart directories, or system paths. Review Tauri app logs for download_file command invocations with unusual filenames. Inspect network traffic for unexpected HTTP requests from Pake apps.

Impact Analysis

If you use a Pake-generated desktop app before version 3.13.1, an attacker could trick you into downloading a file that overwrites critical system or user files. This could lead to loss of data, installation of malicious software, or unauthorized code execution under your user account. Persistence mechanisms like LaunchAgents or Startup folders could allow the attacker to maintain access even after the initial exploit.

Compliance Impact

This vulnerability could lead to unauthorized file writes and code execution on a user's system, potentially compromising sensitive data. For GDPR, it may violate principles of data protection by enabling unauthorized access or modification of personal data. For HIPAA, it could risk unauthorized access to protected health information if exploited in a healthcare context.

Mitigation Strategies

Update Pake to version 3.13.1 or later. Remove any untrusted Pake-generated apps. Audit existing apps for unauthorized file writes or persistence mechanisms. Monitor for unexpected file modifications in user directories.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82635. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart