Critical Severity
CVE-2026-103648
Published: Oct 26, 2026
CVE-2026-103648 | Path Traversal in image-downloader 4.3.0 | CVSS 9.1 Critical | CWE-22 | By EterNullSec
# CVE-2026-103648 — Path Traversal in `image-downloader`
<div align="center">
**Discovered by: [Amirhossein Roustaei (@EterNullSec)](https://roustaei.info) — Eternull Security**
**📖 Full technical writeup: [eternull.net/posts/cve-2026-103648-image-downloader-path-traversal](https://eternull.net/posts/cve-2026-103648-image-downloader-path-traversal)**
> ⚠️ **Educational Purposes Only.** This repository documents a responsibly disclosed vulnerability. All PoC code is intended for authorized security research and testing in isolated lab environments only. Do not use against systems you do not own or have explicit written permission to test.
</div>
---
## 📋 Advisory Summary
| Field | Details |
|-------|---------|
| **CVE ID** | [CVE-2026-103648](https://www.cve.org/CVERecord?id=CVE-2026-103648) |
| **NVD Entry** | [nvd.nist.gov/vuln/detail/CVE-2026-103648](https://nvd.nist.gov/vuln/detail/CVE-2026-103648) |
| **CVSS v3.1 Score** | **9.1 Critical** — `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H` |
| **CWE** | CWE-22: Improper Limitation of a Pathname to a Restricted Directory |
| **Package** | [`image-downloader`](https://www.npmjs.com/package/image-downloader) (npm) by [demsking](https://gitlab.com/demsking/image-downloader) |
| **Weekly npm downloads** | ~11,000 (~38,000/month) — [source](https://api.npmjs.org/downloads/point/last-month/image-downloader) |
| **Affected Versions** | `< 4.3.1` (all versions including `4.3.0`) |