CVE-2026-106103: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in quasarframework quasar

The Quasar Framework's icongenie generate --profile command accepted user-supplied folder and name values without properly constraining the resolved destination path to the Quasar project directory. Specifically, icongenie/lib/utils/get-assets-files.js joined these values with appDir, while icongenie/lib/utils/validate-profile-object.js only required non-empty strings, allowing parent-directory traversal. This improper limitation of pathname to a restricted directory (CWE-22) enables a developer running a crafted profile to write or overwrite files at arbitrary writable paths, potentially affecting shell startup files, build scripts, or other executable configurations. The vulnerability is addressed in icongenie version 6.1.1.

An attacker with the ability to run the icongenie generate --profile command with a crafted profile can cause arbitrary files to be written or overwritten outside the intended project directory. This can lead to modification of shell startup files, build scripts, or other executable configuration files, potentially resulting in code execution or disruption of build processes. The CVSS v3.1 score is 7.1 (High), reflecting local attack vector with low complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, but high integrity and availability impact.

Upgrade to icongenie version 6.1.1 or later, where this path traversal vulnerability is fixed by properly constraining the resolved destination path within the Quasar project directory. No other mitigations are indicated by the vendor advisory.