CVE-2026-103648

CVE-2026-103648 — Path Traversal in image-downloader Discovered by:Amirhossein Roustaei @EterNullSec — Eternull Security 📖 Full technical writeup:eternull.net/posts/cve-2026-103648-image-downloader-path-traversal ⚠️ Educational Purposes Only. This repository documents a responsibly disclosed...

Exploit for CVE-2026-103648

CVE-2026-103648 — Path Traversal in image-downloader !CV...

CVE-2026-103648

Path traversal in image-downloader 4.3.0 allows an attacker who can control the download URL to cause downloaded response data to be written outside the configured destination directory...

CVE-2026-103648

The image-downloader (npm) package, specifically version 4.3.0 , is vulnerable to a path traversal (CWE-22) vulnerability. An attacker capable of controlling the download URL can manipulate the application into writing downloaded response data outside of the configured destination directory. This...

CVE-2026-103648 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in image-downloader

Path traversal in image-downloader 4.3.0 allows an attacker who can control the download URL to cause downloaded response data to be written outside the configured destination directory...

CVE-2026-103648 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in image-downloader

Path traversal in image-downloader 4.3.0 allows an attacker who can control the download URL to cause downloaded response data to be written outside the configured destination directory...

EUVD-2026-91752

Path traversal in image-downloader 4.3.0 allows an attacker who can control the download URL to cause downloaded response data to be written outside the configured destination directory...

CVE-2026-103648 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in image-downloader

Path traversal in image-downloader 4.3.0 allows an attacker who can control the download URL to cause downloaded response data to be written outside the configured destination directory...

@llampukaq/builder (>=0.1.0, <=0.1.1), @llampukaq/realm-email-provider (>=0.1.3, <=0.1.422) +4 more potentially affected by CVE-2026-103648 via image-downloader (>=4.0.1, <=4.3.0)

image-downloader NPM version =4.0.1, =0.1.0, =0.1.3, =0.1.0, =0.1.2, =1.0.0, =2.1.4596 Source cves: CVE-2026-103648 Source advisory: MEND:CVE-2026-103648...

CVE-2026-103648: Improper Limitation of a Pathname to a Restricted Directory

Path traversal in image-downloader 4.3.0 allows an attacker who can control the download URL to cause downloaded response data to be written outside the configured destination directory...

PT-2026-104392

Name of the Vulnerable Software and Affected Versions image-downloader version 4.3.0 Description A path traversal issue exists where an attacker who can control the download URL can cause the downloaded response data to be written outside the configured destination directory. Path traversal is a...

Dify: When Your AI Platform Becomes the Attack Surface

Executive Summary We identified a couple of vulnerabilities in AI automation platform Dify resulting in cross-tenant sensitive information disclosure and one-click account takeover. These findings reinforce the pattern we documented in our previous n8n blogpost: even though AI automation platform...

EUVD-2009-2546

Malware in sbrugna...

EUVD-2008-6059

Malware in sbrugna...

CVE-2009-2551

Multiple cross-site scripting XSS vulnerabilities in ScriptsEz Easy Image Downloader allow remote attackers to inject arbitrary web script or HTML via the id parameter in a detail action to 1 main.php and possibly 2 demopage.php...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in ScriptsEz Easy Image Downloader allow remote attackers to inject arbitrary web script or HTML via the id parameter in a detail action to 1 main.php and possibly 2 demopage.php...

CVE-2009-2551

CVE-2009-2551 describes multiple XSS vulnerabilities in ScriptsEz Easy Image Downloader. The issue is triggered via the id parameter in a detail action to main.php (and possibly demo_page.php), allowing remote script/HTML injection. The provided documents do not include product versions, affected...

CVE-2009-2551: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in ScriptsEz Easy Image Downloader allow remote attackers to inject arbitrary web script or HTML via the id parameter in a detail action to 1 main.php and possibly 2 demopage.php...

Easy Image Downloader Cross Site Scripting

-----------------------------I AM MUSLIM !!------------------------------ ============================================================================== / \ | | | | / \ | | | | / \ | | | | / \ | || | / \ | | | | / \ | | IN THE NAME OF // \ || || // \ || ||...

Scriptsez Easy Image Downloader - 'id' Cross-Site Scripting

source: https://www.securityfocus.com/bid/35701/info Easy Image Downloader is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the...