CVE-2026-82635: Pake arbitrary file write via unsanitized download_file filename
Pake before 3.13.1 joins the JavaScript-supplied filename for the downloadfile Tauri command onto the user's Downloads directory with no sanitization. A filename containing path traversal sequences (for example ../Library/LaunchAgents/com.evil.plist) or an absolute path resolves outside ~/Downloads. The command then fetches attacker-controlled content from the supplied URL (via Rust HTTP, not the browser) and writes it to that path. A script that can invoke the command can overwrite user-writable files and install persistence (macOS LaunchAgents, Linux autostart, Windows Startup), leading to code execution in the user account. All desktop apps generated from an affected Pake tree expose the same command.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Paketo a version that resolves this vulnerability.Fixed in 3.13.1 - Operational
Rebuild all desktop apps generated from the affected Pake tree after upgrading to 3.13.1 or later, so they include sanitize_download_filename and prevent path traversal via download_file.
Event History
Frequently Asked Questions
Which deployments are exposed?
Desktop applications generated from an affected Pake tree are exposed because they all provide the vulnerable download_file command. Pake versions before 3.13.1 are affected.
What does an attacker need to exploit this?
An attacker needs a script that can invoke the download_file Tauri command and user interaction, as reflected by the UI:R vector. The script can supply both a traversal or absolute-path filename and an attacker-controlled download URL.
Are writes limited to the Downloads directory?
No. Although the destination is constructed from the user's Downloads directory, unsanitized traversal sequences or absolute paths can resolve outside it and target user-writable files.
What is the likely impact if exploitation succeeds?
An attacker can overwrite user-writable files and place persistence files such as macOS LaunchAgents, Linux autostart entries, or Windows Startup files. This can lead to code execution in the affected user's account.
What should be done if an affected build cannot immediately be replaced?
The provided data does not describe a workaround. Prioritize preventing untrusted scripts from invoking the download_file command and move to Pake 3.13.1 or later when possible.