CVE-2026-82635 in Pake
Summary
by MITRE • 08/30/2026
Pake before 3.13.1 joins the JavaScript-supplied filename for the download_file Tauri command onto the user's Downloads directory with no sanitization. A filename containing path traversal sequences (for example ../Library/LaunchAgents/com.evil.plist) or an absolute path resolves outside ~/Downloads. The command then fetches attacker-controlled content from the supplied URL (via Rust HTTP, not the browser) and writes it to that path. A script that can invoke the command can overwrite user-writable files and install persistence (macOS LaunchAgents, Linux autostart, Windows Startup), leading to code execution in the user account. All desktop apps generated from an affected Pake tree expose the same command.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/30/2026
The vulnerability identified involves a critical path traversal flaw within the download_file Tauri command of Pake versions prior to 3.13.1, which allows for arbitrary file writes and subsequent remote code execution on desktop applications built using this framework. The core technical deficiency lies in the lack of input sanitization when processing JavaScript-supplied filenames passed to the backend Rust HTTP client. Instead of validating or normalizing the provided filename against a strict allowlist or ensuring it remains within the designated user Downloads directory, the application directly concatenates the untrusted string with the base path. This architectural oversight enables an attacker who can invoke this command through malicious web content embedded in the app to specify file paths that escape the intended sandboxed environment. By utilizing standard path traversal sequences such as ../ or absolute paths like /Library/LaunchAgents/com.evil.plist on macOS, Linux autostart directories, or Windows Startup folders, the application resolves these inputs outside of ~/Downloads and proceeds to write attacker-controlled content directly to those locations.
The operational impact of this vulnerability is severe, as it effectively breaks the security boundaries intended by desktop app wrappers like Pake. Once an arbitrary file can be written to a user-writable directory that executes on login or startup, an attacker gains the ability to install persistence mechanisms without requiring elevated privileges. On macOS systems, writing a plist file to ~/Library/LaunchAgents allows for automatic execution of malicious payloads upon system boot. Similarly, on Linux environments, placing scripts in standard autostart directories achieves equivalent persistent access, while Windows users are susceptible to code execution via files placed in the Startup folder. This capability transforms what might initially appear as a simple data exfiltration or file manipulation issue into a full remote code execution vector within the context of the user account running the application.
From an industry standards perspective, this vulnerability aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, which describes flaws where software does not properly neutralize special elements in filenames that can cause paths to be resolved outside of restricted directories. Furthermore, the exploitation technique maps directly to MITRE ATT&CK techniques related to persistence and privilege escalation within desktop environments. The attack vector typically involves an attacker hosting malicious content on a web server or manipulating network responses so that when the user interacts with the application, JavaScript code triggers the vulnerable download_file command with crafted arguments. Since the HTTP request is made via Rust rather than through the browser's native security model, it bypasses many of the same-origin policies and sandbox restrictions that would otherwise limit such actions in a standard web context.
Mitigation for this vulnerability requires an immediate upgrade to Pake version 3.13.1 or later, where the developers have implemented proper sanitization logic to ensure filenames are normalized and strictly confined within the intended Downloads directory. For applications already deployed using affected versions of Pake, there is no client-side patch available; therefore, users should exercise caution when interacting with desktop apps that may contain this flaw, particularly those sourced from untrusted or unofficial channels. Developers utilizing older builds must recompile their applications after updating the underlying framework to ensure the security fix is integrated into the binary. Additionally, implementing defense-in-depth strategies such as restricting file system permissions for application directories and monitoring for unusual process creation in standard autostart locations can help detect potential exploitation attempts before they result in full compromise.