CVE-2026-105293— Legcord 1.1.0 through 1.3.0 Path Traversal via Theme IPC Handlers
Quick assessment
Affected
Legcord Legcord
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Legcord 1.1.0 至 1.3.0 版本中存在一个路径遍历漏洞，该漏洞位于主题 IPC（进程间通信）处理器中，允许通过未经验证的主题 ID，使 Discord 页面中的脚本突破主题目录的限制。攻击者若在 Discord 原始来源中执行脚本（例如通过跨站脚本攻击 XSS），可利用 、 和 等功能，在主题目录之外执行本地可执行程序、递归删除目录以及写入任意文件。
Possible ATT&CK Techniques 3 AI
T1055 · Process Injection T1059 · Command and Scripting Interpreter T1530 · Data from Cloud Storage
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-105293
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Legcord 1.1.0 through 1.3.0 Path Traversal via Theme IPC Handlers
Source: CVE Program / CVE List V5
Vulnerability Description
Legcord 1.1.0 through 1.3.0 contains a path traversal vulnerability in theme IPC handlers that allows script in the Discord page to escape the themes directory via unvalidated theme ids. Attackers running script in the Discord origin, such as through XSS, can abuse themes.folder, themes.uninstall, and themes.install to launch local executables, recursively delete directories, and write files outside the themes directory.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-105293
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-105293
请登录查看更多情报信息。
Other References for CVE-2026-105293 (5)
-
https://github.com/Legcord/Legcord/blob/v1.3.0/src/common/themes.ts#L269-L276 technical-description
-
https://github.com/Legcord/Legcord/blob/v1.3.0/src/discord/ipc.ts#L201-L206 technical-description
-
https://github.com/Legcord/Legcord/issues/1163 issue-tracking
IV. Related Vulnerabilities
Same weakness: CWE-22
-
CVE-2026-105174
Gerapy Project Management views.py project_create path trave -
CVE-2026-105157
RainyGao DocSys Document Controller doGetTmpFile.do DocContr -
CVE-2026-105144
Drogon Static File Router StaticFileRouter.cc route path tra -
CVE-2026-105125
LaraDashboard before 1.4.8 Path Traversal via /api/translati -
CVE-2026-104983
Linux Mint Xreader PDF Attachment Saving ev-window.c g_file_
V. Comments for CVE-2026-105293
No comments yet