Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-106103— Quasar Framework: Path Traversal / Arbitrary File Write via crafted Icon Genie profile

Quick assessment

Affected
quasarframework quasar
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Quasar Framework 是一个用于构建高性能 Vue.js 用户界面的框架。在 @quasar/icongenie 6.1.1 版本之前， 命令允许用户通过自行提供的配置文件传入文件夹路径和名称值，但并未将这些解析后的目标路径限制在 Quasar 项目目录内。具体而言， 将这些值与 （应用目录）拼接，而 仅要求输入为非空字符串，从而导致了目录遍历漏洞。如果开发人员运行了一个精心构造的配置文件，就可能使生成的图像内容被写入或覆盖到该用户有权写入的任意路径，进而可能篡改 Shell 启动文件、构建脚本或其他可

CVSS 7.1 · High

Affected Version Matrix 2

VendorProduct Version RangeStatus
@quasar icongenie < 6.1.1 affected
quasarframework quasar < 2.22.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-106103

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Quasar Framework: Path Traversal / Arbitrary File Write via crafted Icon Genie profile
Source: CVE Program / CVE List V5
Vulnerability Description
Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/icongenie 6.1.1, the icongenie generate --profile command accepted folder and name values from a user-supplied profile without constraining the resolved destination to the Quasar project directory. icongenie/lib/utils/get-assets-files.js joined those values with appDir, while icongenie/lib/utils/validate-profile-object.js required only non-empty strings, allowing parent-directory traversal. A developer who runs a crafted profile can cause generated image content to be written or overwritten at any path writable by that user, potentially modifying shell startup files, build scripts, or other executable configuration. This issue is fixed in version 6.1.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
quasarframework quasar < 2.22.0 -
@quasar icongenie < 6.1.1 -

II. Public POCs for CVE-2026-106103

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-106103

请登录查看更多情报信息。

Other References for CVE-2026-106103 (3)

Same Patch Batch · quasarframework · 2026-10-06 · 8 CVEs total

CVE-2026-106102 10.0 CRITICAL Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead()
CVE-2026-106104 8.7 HIGH Quasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Q
CVE-2026-106105 8.4 HIGH Quasar Framework: Development TLS private keys are cached with overly permissive filesyste
CVE-2026-106107 8.3 HIGH Quasar Framework: App Vite SSR and SSG nonce attributes are not safely constrained
CVE-2026-106106 7.1 HIGH Quasar Framework: SSR/SSG dev error page discloses the full shell environment and its </sc
CVE-2026-106109 4.1 MEDIUM Quasar Framework: App Vite build cleanup can recursively remove unsafe configured output d
CVE-2026-106101 3.1 LOW Quasar Framework: DOM Clobbering in Quasar openURL() SafariViewController Integration Caus

IV. Related Vulnerabilities

Same product: quasar
Same vendor: quasarframework
Same weakness: CWE-22

V. Comments for CVE-2026-106103

No comments yet

Leave a comment