Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-82635: Pake lets attackers write files outside Downloads folder

CVE-2026-82635 · published 2 months ago

Summary

The Pake tool (versions before 3.13.1) can be tricked into saving files to any location on a user's computer, not just the Downloads folder. This means a malicious script could replace important startup files and cause the user's account to run unwanted code. Update Pake to the latest version or apply a patch that validates file names before saving.

What to do

Update tw93 pake to version 3.13.1 or later.
Update faberon pake to version 3.13.1 or later.

Affected software

Vendor	Product	Affected versions
tw93	pake	< 3.13.1
faberon	pake	< 3.13.1 `cpe:2.3:a:faberon:pake::::::::`

Original advisory text

Pake arbitrary file write via unsanitized download_file filename

Pake before 3.13.1 joins the JavaScript-supplied filename for the download_file Tauri command onto the user's Downloads directory with no sanitization. A filename containing path traversal sequences (for example ../Library/LaunchAgents/com.evil.plist) or an absolute path resolves outside ~/Downloads. The command then fetches attacker-controlled content from the supplied URL (via Rust HTTP, not the browser) and writes it to that path. A script that can invoke the command can overwrite user-writable files and install persistence (macOS LaunchAgents, Linux autostart, Windows Startup), leading to code execution in the user account. All desktop apps generated from an affected Pake tree expose the same command.

References

https://github.com/tw93/Pake/releases/tag/V3.13.1 Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82635... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-82635 Vendor Advisory
https://github.com/tw93/Pake/commit/a5463a84d6e36705ee0dd1886cf0e4b5a75b0ab4 Patch
https://github.com/tw93/Pake Product

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

8.8 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-22Path Traversal

Timeline

Published30 Aug 2026

Updated4 Nov 2026

First seen30 Aug 2026

Sources

CVE-2026-82635 · NVD

CVE-2026-82635 · MITRE

CVE-2026-82635 · OSV

Track software like this

Free during beta