CVE-2026-100230 in Input Leap
Summary
by MITRE • 09/25/2026
Input Leap (aka input-leap) through 3.0.3, when the non-default --enable-drag-drop option is used on Windows or macOS, mishandles the / versus \ distinction and allows directory traversal, with resultant code execution if a file is written to a startup directory. This occurs via a DDRG message.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/25/2026
The vulnerability identified in Input Leap, also known as input-leap, through version 3.0.3 represents a critical security flaw rooted in improper handling of path separators within the application's drag-and-drop functionality. Specifically, this issue manifests when the non-default --enable-drag-drop option is utilized on Windows or macOS operating systems. The core technical deficiency lies in the software's failure to correctly distinguish between forward slashes (/) and backslashes (\) when processing file paths received via DDRG messages. This lack of normalization allows an attacker to construct malicious path strings that bypass intended directory constraints, leading directly to a directory traversal attack where files can be written outside the expected sandboxed or application-specific directories.
From a technical perspective, the flaw exploits the ambiguity in how different operating systems interpret file paths and how the application processes these inputs without adequate sanitization. On Windows, backslashes are standard path separators, while forward slashes are often accepted but may not trigger the same validation logic as intended by developers who might assume strict adherence to one format or fail to normalize both formats before checking against allowed directories. By injecting a sequence such as ..\..\ or ../..../ into the DDRG message payload, an attacker can traverse up the directory tree from the designated drop target location. This mechanism effectively neutralizes any boundary checks that rely on simple string matching of the initial path segment, allowing writes to arbitrary locations on the file system where the user executing Input Leap has write permissions.
The operational impact of this vulnerability is severe due to its potential for remote code execution under specific conditions. If an attacker can trick a victim into dropping a malicious executable or script via the drag-and-drop interface and that action results in the file being written to a startup directory, such as the Windows Startup folder or macOS Login Items location, the payload will execute automatically upon system boot or user login. This transforms a simple path traversal issue into a persistent code execution vector. The attacker does not need direct shell access; instead, they leverage the legitimate application's privileges and its ability to write files in sensitive locations to achieve arbitrary command execution on the victim's machine.
This vulnerability aligns with Common Weakness Enumeration (CWE) categories such as CWE-22: Improper Limitation of a Pathname to a Restricted Directory, which describes scenarios where software does not properly validate input paths against an expected directory structure. Additionally, it relates to CWE-78: Improper Neutralization of Special Elements used in an OS Command, particularly when the written file is subsequently executed by system mechanisms like startup scripts or services. In terms of the MITRE ATT&CK framework, this behavior facilitates techniques associated with Persistence and Privilege Escalation, specifically those involving modification of default configurations to ensure malicious code runs automatically without user interaction beyond the initial drop action.
Mitigation strategies for this vulnerability primarily involve updating Input Leap to a version where the path handling logic has been corrected to strictly normalize all incoming paths using canonicalization techniques that account for both forward and backward slashes regardless of the host operating system's native separator. Developers should implement strict allow-listing for target directories, ensuring that resolved absolute paths remain within predefined safe boundaries before any file write operations are permitted. Furthermore, applications handling drag-and-drop events on desktop environments should validate not only the path but also the content type and destination permissions to prevent writes to sensitive system locations like startup folders or application data directories reserved for trusted processes. Until patched, users are advised to disable the --enable-drag-drop option if it is not strictly necessary for their workflow, thereby removing the attack surface associated with DDRG message processing entirely.