Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.8
CVE-2026-82635: Pake lets attackers overwrite files via download command
CVE-2026-82635 · published 4 days ago
Summary
The Pake tool (versions before 3.13.1) lets a program tell the system to save a file using any name the attacker chooses. By using special path tricks, the attacker can place the file outside the normal download folder and replace important startup files, giving them the ability to run code whenever the user logs in. Update Pake to version 3.13.1 or later, or block the download command until the patch is applied.
What to do
- Update tw93 pake to version 3.13.1 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| tw93 | pake | < 3.13.1 |
Original advisory text
Pake arbitrary file write via unsanitized download_file filename
Pake before 3.13.1 joins the JavaScript-supplied filename for the download_file Tauri command onto the user's Downloads directory with no sanitization. A filename containing path traversal sequences (for example ../Library/LaunchAgents/com.evil.plist) or an absolute path resolves outside ~/Downloads. The command then fetches attacker-controlled content from the supplied URL (via Rust HTTP, not the browser) and writes it to that path. A script that can invoke the command can overwrite user-writable files and install persistence (macOS LaunchAgents, Linux autostart, Windows Startup), leading to code execution in the user account. All desktop apps generated from an affected Pake tree expose the same command.
References
Severity
8.8
High
CVSS 3.1: 8.8 (MITRE)
Exploitation
EPSS <1%
Type
CWE-22Path Traversal
Timeline
Published30 Aug 2026
Updated2 Sep 2026
First seen30 Aug 2026
Monitor software like this
Free during beta