CVE-2026-22685

CVE-2026-22685 describes a path traversal vulnerability in DevToys versions 2.0.0.0–2.0.8.x (before 2.0.9.0) affecting the extension installation mechanism. When processing NUPKG extension archives, the product does not adequately validate archive file paths, enabling crafted entries like ../../…...