Search: CVE-2026-82635

Pake versions before 3.13.1 contain a path traversal vulnerability in the download_file Tauri command. The vulnerability allows an attacker to specify filenames with path traversal sequences or absolute paths, causing files to be written outside the intended Downloads directory. This can lead to overwriting user-writable files and installing persistence mechanisms such as macOS LaunchAgents, Linux autostart entries, or Windows Startup entries, resulting in code execution within the user account.