CVE-2026-43616CWE-23

Detect-It-Easy < 3.21 Path Traversal Arbitrary File Write

Medium · published May 4, 2026

CVSS v4.0
6.8
EPSS
0%
Percentile
11.4
In the wild
Unconfirmed
What it is

Detect-It-Easy prior to 3.21 contains a path traversal vulnerability that allows attackers to write arbitrary files to the filesystem by crafting malicious archive entries with relative traversal sequences or absolute paths. Attackers can exploit insufficient path normalization during archive extraction to write files outside the intended extraction directory and achieve persistent code execution by overwriting user startup scripts.

The record
Technical detail
CVSS v4.0
6.8 · MEDIUM
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00216 · 11.4th percentile
Weakness
CWE-23 · Relative Path Traversal
Published
2026-05-04T17:33Z
EPSS history
Timeline
  • 04 MAY 17:33Z
    Detect-It-Easy < 3.21 Path Traversal Arbitrary File Write
    cvelistv5