CVE-2026-106103
Received Received - Intake

Path Traversal in Quasar Framework's icongenie

Publication date: 2026-10-06

Last updated on: 2026-10-06

Assigner: GitHub, Inc.

Description
Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/icongenie 6.1.1, the icongenie generate --profile command accepted folder and name values from a user-supplied profile without constraining the resolved destination to the Quasar project directory. icongenie/lib/utils/get-assets-files.js joined those values with appDir, while icongenie/lib/utils/validate-profile-object.js required only non-empty strings, allowing parent-directory traversal. A developer who runs a crafted profile can cause generated image content to be written or overwritten at any path writable by that user, potentially modifying shell startup files, build scripts, or other executable configuration. This issue is fixed in version 6.1.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-06
Last Modified
2026-10-06
Generated
2026-10-06
AI Q&A
2026-10-06
EPSS Evaluated
N/A
NVD
CVE-2026-106103
EUVD
EUVD-2026-93568

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
quasarframework quasar < 2.22.0
@quasar icongenie < 6.1.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-73 The product allows user input to control or influence paths or file names that are used in filesystem operations.
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Quasar Framework's icongenie tool before version 6.1.1 has a directory traversal vulnerability. The tool's generate --profile command allowed user-supplied folder and name values that were not restricted to the Quasar project directory. This could let an attacker write or overwrite files anywhere the user has write permissions, including critical system or configuration files.

Detection Guidance

Check if @quasar/icongenie versions prior to 6.1.1 are installed by running: npm list @quasar/icongenie. If the version is less than 6.1.1, the system is vulnerable.

Impact Analysis

If exploited, this flaw could allow an attacker to overwrite important files like shell startup scripts, build scripts, or configuration files. This might lead to arbitrary code execution, system compromise, or disruption of services relying on those files.

Compliance Impact

This vulnerability could lead to unauthorized file modifications, potentially violating integrity and confidentiality requirements in GDPR and HIPAA. Unauthorized changes to system files may result in non-compliance with data protection and security standards.

Mitigation Strategies

Update @quasar/icongenie to version 6.1.1 or later using: npm update @quasar/icongenie. Avoid running icongenie generate --profile with untrusted profile files.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-106103. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart