Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-82635— Pake arbitrary file write via unsanitized download_file filename

Quick assessment

Affected
tw93 Pake
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Pake 3.13.1 之前的版本中， Tauri 命令将 JavaScript 提供的文件名直接拼接到用户的“下载”目录路径后，且未进行任何净化处理。如果文件名中包含路径遍历序列（例如 ）或绝对路径，文件就会被写入到 目录之外。该命令会通过 Rust 内置的 HTTP 客户端（而非浏览器）从攻击者控制的 URL 获取内容，并将其写入指定路径。能够调用该命令的脚本可以覆盖用户可写的文件，并安装持久化机制（如 macOS 的 LaunchAgents、Linux 的 autostart、Windows 的 Sta

CVSS 8.8 · High

Possible ATT&CK Techniques 1 AI

T1547.002 · Authentication Package
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-82635

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Pake arbitrary file write via unsanitized download_file filename
Source: CVE Program / CVE List V5
Vulnerability Description
Pake before 3.13.1 joins the JavaScript-supplied filename for the download_file Tauri command onto the user's Downloads directory with no sanitization. A filename containing path traversal sequences (for example ../Library/LaunchAgents/com.evil.plist) or an absolute path resolves outside ~/Downloads. The command then fetches attacker-controlled content from the supplied URL (via Rust HTTP, not the browser) and writes it to that path. A script that can invoke the command can overwrite user-writable files and install persistence (macOS LaunchAgents, Linux autostart, Windows Startup), leading to code execution in the user account. All desktop apps generated from an affected Pake tree expose the same command.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
tw93 Pake 0 ~ 3.13.1 -

II. Public POCs for CVE-2026-82635

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-82635

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-82635 (1)

Proof of Concept for CVE-2026-82635 (1)

Vendor Pages for CVE-2026-82635 (1)

IV. Related Vulnerabilities

Same weakness: CWE-22

V. Comments for CVE-2026-82635

No comments yet

Leave a comment