CVE-2026-82635: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in tw93 Pake

Pake before version 3.13.1 improperly limits pathname input for the download_file Tauri command by joining a JavaScript-supplied filename to the user's Downloads directory without sanitization. This allows an attacker to use path traversal sequences or absolute paths to write files outside the Downloads folder. The command fetches attacker-controlled content via Rust HTTP and writes it to the specified path. Exploitation can overwrite user-writable files and install persistence mechanisms on macOS, Linux, and Windows, leading to code execution in the context of the user. All desktop applications generated from an affected Pake tree expose this vulnerable command.

Successful exploitation can lead to arbitrary file overwrite and installation of persistence mechanisms on the victim's system, resulting in code execution with the privileges of the user running the affected application. This compromises the confidentiality, integrity, and availability of the user's environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid running untrusted scripts that invoke the download_file Tauri command or use affected versions of Pake. Monitor vendor communications for updates on remediation.