CVE-2026-43616 is a path traversal vulnerability (CWE-23) in the horsicq DIE-engine component of Detect-It-Easy prior to version 3.21. The vulnerability arises from insufficient path normalization during archive extraction, enabling attackers to write files arbitrarily on the filesystem by using crafted archive entries containing relative traversal sequences or absolute paths. This can lead to persistent code execution if critical user startup scripts are overwritten. The vulnerability requires local access (attack vector: local) and user interaction, with no privileges required.

Successful exploitation allows an attacker to write arbitrary files outside the intended extraction directory, potentially overwriting user startup scripts. This can lead to persistent code execution under the context of the user running the application. The vulnerability does not require privileges but does require user interaction and local access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid extracting untrusted archives with Detect-It-Easy versions prior to 3.21. Monitor vendor channels for updates and apply patches once released.