CVE-2026-105293
Received Received - Intake

Legcord Theme IPC Path Traversal Vulnerability

Publication date: 2026-10-05

Last updated on: 2026-10-05

Assigner: VulnCheck

Description
Legcord 1.1.0 through 1.3.0 contains a path traversal vulnerability in theme IPC handlers that allows script in the Discord page to escape the themes directory via unvalidated theme ids. Attackers running script in the Discord origin, such as through XSS, can abuse themes.folder, themes.uninstall, and themes.install to launch local executables, recursively delete directories, and write files outside the themes directory.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-05
Last Modified
2026-10-05
Generated
2026-10-05
AI Q&A
2026-10-05
EPSS Evaluated
N/A
NVD
CVE-2026-105293
EUVD
EUVD-2026-92157

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
legcord legcord From 1.1.0 (inc) to 1.3.0 (inc)
legcord legcord From 1.2.4 (inc) to 1.3.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Legcord versions 1.1.0 through 1.3.0 have a path traversal vulnerability in theme IPC handlers. This allows scripts running in the Discord page to escape the themes directory by exploiting unvalidated theme IDs. Attackers can use functions like themes.folder, themes.uninstall, and themes.install to execute local programs, delete directories recursively, or write files outside the themes directory.

Detection Guidance

Check Legcord versions installed on your system. If using 1.1.0 through 1.3.0, the system is vulnerable. Review themes directory permissions and logs for unusual file operations or deletions.

Impact Analysis

An attacker could exploit this to run malicious programs on your system, delete important files or directories, or write harmful files outside the intended themes folder. This could lead to data loss, system compromise, or further malware infections if combined with other vulnerabilities.

Compliance Impact

This vulnerability could lead to unauthorized file access, data exfiltration, or remote code execution, which may violate GDPR's data protection requirements for secure processing and HIPAA's safeguards for protected health information. Unauthorized file operations could expose sensitive user data, leading to compliance breaches.

Mitigation Strategies

Upgrade Legcord to a version beyond 1.3.0 if available. Disable or uninstall Legcord temporarily until patched. Restrict file system permissions for the themes directory to limit write access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-105293. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart