Threat database

CVE-2026-103648 is a critical path traversal vulnerability in demsking image-downloader version 4.3.0 and earlier. It allows an attacker who can control the download URL to write downloaded data outside the intended destination directory, potentially leading to arbitrary file overwrite. This vulnerability has a high CVSS score of 9.1, indicating severe impact on integrity and availability without requiring privileges or user interaction.