CVE-2026-105293 in Legcord
Summary
by MITRE • 10/05/2026
Legcord 1.1.0 through 1.3.0 contains a path traversal vulnerability in theme IPC handlers that allows script in the Discord page to escape the themes directory via unvalidated theme ids. Attackers running script in the Discord origin, such as through XSS, can abuse themes.folder, themes.uninstall, and themes.install to launch local executables, recursively delete directories, and write files outside the themes directory.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/05/2026
Legcord versions 1.1.0 through 1.3.0 suffer from a critical path traversal vulnerability within its theme inter-process communication handlers, which fundamentally compromises the integrity of the application's file system isolation mechanisms. This flaw arises because the software fails to properly validate or sanitize user-supplied input when processing requests related to theme management operations such as installation, uninstallation, and folder access. Specifically, the functions themes.folder, themes.uninstall, and themes.install accept a theme identifier that is directly concatenated into file paths without adequate checks for directory traversal sequences like dot-dot-slash characters. This lack of validation allows an attacker who has successfully injected malicious scripts within the Discord origin context to manipulate these internal APIs in ways intended only by legitimate application logic.
The operational impact of this vulnerability is severe, as it effectively breaks the sandboxing boundaries that are typically enforced between web-based content and local system resources. By exploiting the unvalidated theme identifiers, an attacker can construct file paths that escape the designated themes directory and access arbitrary locations on the host operating system's file structure. This capability enables a range of destructive actions including the recursive deletion of critical directories, which can lead to significant data loss or application instability. Furthermore, the vulnerability allows for unauthorized file writes outside the restricted theme folder, potentially overwriting legitimate configuration files or placing malicious artifacts in sensitive areas of the filesystem where they may persist across sessions or be executed by other system processes.
Beyond simple file manipulation, this path traversal flaw facilitates arbitrary code execution on the victim's machine. Since Legcord is an Electron-based application, it possesses elevated privileges compared to standard web browsers due to its ability to interact with native operating system APIs. An attacker leveraging cross-site scripting vectors within Discord can abuse these theme handlers to launch local executables located anywhere on the disk where the user has execution permissions. This transforms a typical client-side script injection into a full remote code execution scenario, allowing for complete compromise of the end-user's environment, including potential access to sensitive data stored locally or further lateral movement if combined with other system vulnerabilities.
From a classification perspective, this vulnerability aligns closely with CWE-22 Improper Limitation of a Pathname to a Restricted Directory and CWE-94 Code Injection via User-Controlled Data. The exploitation technique maps directly to the MITRE ATT&CK framework techniques related to Command and Scripting Interpreter execution as well as File and Directory Discovery, highlighting how web-originated attacks can bridge into native application behaviors when input validation is insufficient. To mitigate this risk, users should immediately upgrade Legcord to a version newer than 1.3.0 where these path traversal issues have been addressed through rigorous input sanitization and strict allow-listing of theme identifiers. Developers must ensure that all file system operations involving user-supplied paths implement canonicalization checks and verify that the resolved path remains within the expected base directory before performing any read or write actions, thereby preventing escape from restricted contexts.