CVE-2026-22685

{"id": "CVE-2026-22685", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-22685", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-01-12T14:39:22.248923Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "DevToys-app", "product": "DevToys", "versions": [{"status": "affected", "version": ">= 2.0.0.0, < 2.0.9.0"}]}]}], "published": "2026-01-10T06:15:51.743", "references": [{"url": "https://github.com/DevToys-app/DevToys/commit/02fb7d46d9c663a4ee6ed968baa6a8810405047f", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/DevToys-app/DevToys/pull/1643", "tags": ["Issue Tracking", "Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/DevToys-app/DevToys/security/advisories/GHSA-ggxr-h6fm-p2qh", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "DevToys is a desktop app for developers. In versions from 2.0.0.0 to before 2.0.9.0, a path traversal vulnerability exists in the DevToys extension installation mechanism. When processing extension packages (NUPKG archives), DevToys does not sufficiently validate file paths contained within the archive. A malicious extension package could include crafted file entries such as ../../\u2026/target-file, causing the extraction process to write files outside the intended extensions directory. This flaw enables an attacker to overwrite arbitrary files on the user\u2019s system with the privileges of the DevToys process. Depending on the environment, this may lead to code execution, configuration tampering, or corruption of application or system files. This issue has been patched in version 2.0.9.0."}, {"lang": "es", "value": "DevToys es una aplicaci\u00f3n de escritorio para desarrolladores. En versiones desde la 2.0.0.0 hasta antes de la 2.0.9.0, existe una vulnerabilidad de salto de ruta en el mecanismo de instalaci\u00f3n de extensiones de DevToys. Al procesar paquetes de extensiones (archivos NUPKG), DevToys no valida suficientemente las rutas de archivo contenidas dentro del archivo. Un paquete de extensi\u00f3n malicioso podr\u00eda incluir entradas de archivo manipuladas como ../../\u2026/target-file, haciendo que el proceso de extracci\u00f3n escriba archivos fuera del directorio de extensiones previsto. Esta falla permite a un atacante sobrescribir archivos arbitrarios en el sistema del usuario con los privilegios del proceso de DevToys. Dependiendo del entorno, esto puede llevar a la ejecuci\u00f3n de c\u00f3digo, la manipulaci\u00f3n de la configuraci\u00f3n o la corrupci\u00f3n de archivos de aplicaci\u00f3n o del sistema. Este problema ha sido parcheado en la versi\u00f3n 2.0.9.0."}], "lastModified": "2026-06-17T10:20:13.887", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:devtoys:devtoys:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1E05DD68-AE09-4AC6-9496-27EE7C537F64", "versionEndExcluding": "2.0.9.0", "versionStartIncluding": "2.0.1.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}