PT-2026-2240 · Devtoys · Devtoys
Lihnucs
·
Publicado
2026-01-10
·
Atualizado
2026-03-12
·
CVE-2026-22685
CVSS v3.1
9.8
Crítica
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
DevToys versions 2.0.0.0 through 2.0.8.0
Description
DevToys, a desktop application for developers, contains a path traversal flaw in its extension installation process. When handling extension packages (NUPKG archives), the application inadequately validates file paths within the archive. A specially crafted extension package containing malicious file entries, such as
../../…/target-file, could allow an attacker to write files outside the intended extensions directory. This could lead to overwriting arbitrary files on the user’s system with the privileges of the DevToys process, potentially resulting in code execution, configuration changes, or data corruption. The vulnerability is triggered when processing extension packages and involves insufficient validation of file paths within the archive. The vulnerable component is the extension installation mechanism.Recommendations
DevToys versions 2.0.0.0 through 2.0.8.0 should be updated to version 2.0.9.0 or later.
Exploit
Correção
Path traversal
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Devtoys