CVE-2026-103648
Critical · CVSS 9.1- CVSS
- 9.1
- nvd
- EPSS
- 0.41%
- 33th pct
- KEV
- No
- Class
- oss containerizable
- CWE-22
Description
Path traversal in image-downloader 4.3.0 allows an attacker who can control the download URL to cause downloaded response data to be written outside the configured destination directory.
References
Status: profiled · ingested 2026-10-03T18:00:02.000Z