CVE-2026-82635: Pake arbitrary file write via unsanitized download_file filename

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-30 · updated 2026-09-04
Weakness: CWE-22

Description

Pake before 3.13.1 joins the JavaScript-supplied filename for the download_file Tauri command onto the user's Downloads directory with no sanitization. A filename containing path traversal sequences (for example ../Library/LaunchAgents/com.evil.plist) or an absolute path resolves outside ~/Downloads. The command then fetches attacker-controlled content from the supplied URL (via Rust HTTP, not the browser) and writes it to that path. A script that can invoke the command can overwrite user-writable files and install persistence (macOS LaunchAgents, Linux autostart, Windows Startup), leading to code execution in the user account. All desktop apps generated from an affected Pake tree expose the same command.

Affected products

tw93 Pake: before 3.13.1 — fixed in 3.13.1

How to fix

Upgrade to a fixed version: tw93 Pake 3.13.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-82635 or the next vulnerability affects your stack