https://seclists.org/oss-sec/2026/q3/936: [NotCVE-2026-0014] Input Leap 3.0.3 Drag-and-Drop File Transfer Path Traversal Allows Arbitrary File Write Outside the Drop Dictory

Q: Which systems are in scope?

Windows and macOS installations of Input Leap are affected through version 3.0.3, which is the final release, as well as the master branch. The advisory does not identify any fixed release.

Q: What access does an attacker need?

The attacker must be a connected peer and have low privileges, as reflected by the PR:L metric. Exploitation is rated high complexity and does not require user interaction.

Q: What is the practical impact on Windows?

A peer can write outside the configured drop-target directory. If a file is written to the receiving user's Startup folder, it can execute as that user at their next login.

Q: Is upgrading likely to remediate this issue?

No fixed version exists or is expected. The Input Leap repository was archived read-only on 26 July 2026.

Published Sep 25, 2026

Updated

Affected Software

1 affected component

Input Leap Input Leap<=3.0.3

Frequently Asked Questions

Which systems are in scope?

Windows and macOS installations of Input Leap are affected through version 3.0.3, which is the final release, as well as the master branch. The advisory does not identify any fixed release.

What access does an attacker need?

The attacker must be a connected peer and have low privileges, as reflected by the PR:L metric. Exploitation is rated high complexity and does not require user interaction.

What is the practical impact on Windows?

A peer can write outside the configured drop-target directory. If a file is written to the receiving user's Startup folder, it can execute as that user at their next login.

Is upgrading likely to remediate this issue?

No fixed version exists or is expected. The Input Leap repository was archived read-only on 26 July 2026.