CVE catalog

CVE-2026-43616

Detect-It-Easy prior to 3.21 contains a path traversal vulnerability that allows attackers to write arbitrary files to the filesystem by crafting malicious archive entries with relative traversal sequ

[CVE catalog]

Severity
Medium · CVSS 6.8CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Published
Source
[NVD] · [CVE record]
EPSS
0.17% · Oct 25, 2026

Detect-It-Easy prior to 3.21 contains a path traversal vulnerability that allows attackers to write arbitrary files to the filesystem by crafting malicious archive entries with relative traversal sequences or absolute paths. Attackers can exploit insufficient path normalization during archive extraction to write files outside the intended extraction directory and achieve persistent code execution by overwriting user startup scripts.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Cpedetect-it-easyNot reported3.21fixed
Cpedetect-it-easyNot reported3.21fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Cpedetect-it-easycpeNot reported3.21Not reportedNot reportedNot reported
Cpedetect-it-easycpeNot reported3.21Not reportedNVD-CVE-2026-43616Not reported

OpenFactory catalog packages

No matching packages in this catalog.

Observed:

References

[FIRST EPSS] · [National Vulnerability Database (NVD)]