CVE-2026-22685 is a path traversal vulnerability categorized under CWE-22 found in the DevToys desktop application, specifically in its extension installation mechanism. DevToys processes extension packages in the form of NUPKG archives. In versions from 2.0.0.0 up to but not including 2.0.9.0, the application insufficiently validates file paths within these archives. An attacker can craft a malicious extension package containing file entries with relative path components such as '../../…/target-file'. When DevToys extracts these files, it fails to restrict the extraction path to the intended extensions directory, allowing files to be written arbitrarily anywhere on the file system accessible by the DevToys process. This can lead to overwriting critical system or application files, enabling potential code execution, configuration manipulation, or data corruption. The vulnerability is remotely exploitable over the network (AV:N) without authentication (PR:N) but requires user interaction (UI:R) to install the malicious extension. The scope is unchanged (S:U), but the impact on confidentiality, integrity, and availability is high (C:H/I:H/A:H), resulting in a CVSS 3.1 score of 8.8. No known exploits are reported in the wild as of publication. The issue was addressed in DevToys version 2.0.9.0 by implementing proper path validation during extension extraction.

For European organizations, this vulnerability poses a significant risk, particularly for software development teams and environments where DevToys is used to manage developer utilities and extensions. Successful exploitation can lead to arbitrary file overwrites, potentially allowing attackers to execute malicious code with the privileges of the DevToys process, which may be user-level but could be elevated in some environments. This could result in unauthorized access to sensitive data, disruption of development workflows, or compromise of system stability. Given the high integrity and availability impact, critical development infrastructure could be disrupted, affecting productivity and potentially leading to broader security incidents if attackers leverage this foothold to escalate privileges or move laterally. The requirement for user interaction limits mass exploitation but targeted attacks against developers or IT staff remain a concern. The absence of known exploits in the wild suggests a window for proactive mitigation.

European organizations should immediately update DevToys to version 2.0.9.0 or later to remediate this vulnerability. Until updates are applied, restrict the installation of extensions to trusted sources only, and implement policies that prevent users from installing unverified or third-party extensions. Employ endpoint protection solutions capable of detecting suspicious file extraction or modification activities. Conduct user awareness training emphasizing the risks of installing untrusted extensions. Additionally, implement application whitelisting and monitor file system changes in directories commonly targeted by DevToys extensions. For environments with elevated privileges, consider running DevToys with the least privileges necessary to limit the impact of potential exploitation. Regularly audit installed extensions and verify their integrity. Network-level controls can also be used to block access to known malicious extension distribution points.