The vulnerability identified as CVE-2026-103648 in demsking image-downloader (versions >=0 and <4.3.1) is an improper limitation of a pathname to a restricted directory (CWE-22). Specifically, an attacker controlling the download URL can exploit this flaw to cause the application to write response data outside the configured destination directory. This path traversal issue can be leveraged to overwrite arbitrary files, leading to high impact on integrity and availability. The CVSS v3.1 score is 9.1, indicating critical severity with network attack vector, low attack complexity, no privileges or user interaction required, and impacts on integrity and availability.

Successful exploitation allows an attacker to write files outside the intended directory, potentially overwriting critical files or placing malicious files on the system. This can compromise system integrity and availability. There is no indication of confidentiality impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or official fixes are provided, users should monitor the vendor's announcements for updates. Until a fix is available, restrict access to the image-downloader service and validate or sanitize download URLs to prevent exploitation.