CVE-2026-100230

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-100230", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "state": "PUBLISHED", "assignerShortName": "mitre", "dateReserved": "2026-09-25T15:31:52.007Z", "datePublished": "2026-09-25T15:31:52.421Z", "dateUpdated": "2026-09-25T16:09:08.291Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unknown", "platforms": ["Windows", "MacOS"], "product": "Input Leap", "vendor": "input-leap", "versions": [{"lessThanOrEqual": "3.0.3", "status": "affected", "version": "0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "value": "Input Leap (aka input-leap) through 3.0.3, when the non-default --enable-drag-drop option is used on Windows or macOS, mishandles the / versus \\ distinction and allows directory traversal, with resultant code execution if a file is written to a startup directory. This occurs via a DDRG message."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-180", "description": "CWE-180 Incorrect Behavior Order: Validate Before Canonicalize", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-09-25T15:35:14.634Z"}, "references": [{"tags": ["technical-description", "product"], "url": "https://github.com/input-leap/input-leap/blob/v3.0.3/src/lib/inputleap/DragInformation.cpp"}, {"tags": ["technical-description", "product"], "url": "https://github.com/input-leap/input-leap/blob/master/src/lib/inputleap/DropHelper.cpp"}, {"tags": ["technical-description", "product"], "url": "https://raw.githubusercontent.com/input-leap/input-leap/v3.0.3/src/lib/server/Server.cpp"}, {"tags": ["technical-description", "product"], "url": "https://raw.githubusercontent.com/input-leap/input-leap/master/src/lib/inputleap/ArgParser.cpp"}, {"tags": ["technical-description", "product"], "url": "https://raw.githubusercontent.com/input-leap/input-leap/master/src/lib/net/SecureSocket.cpp"}, {"tags": ["product"], "url": "https://github.com/input-leap/input-leap/releases"}, {"tags": ["technical-description", "related"], "url": "https://raw.githubusercontent.com/debauchee/barrier/master/src/lib/barrier/DragInformation.cpp"}, {"tags": ["vdb-entry", "related"], "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-42072"}, {"tags": ["related"], "url": "https://github.com/deskflow/deskflow/security/advisories"}, {"tags": ["third-party-advisory"], "url": "https://www.openwall.com/lists/oss-security/2026/09/25/4"}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-25T16:08:59.786693Z", "id": "CVE-2026-100230", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-25T16:09:08.291Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-100230", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-25T16:08:59.786693Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-25T16:09:04.181Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "input-leap", "product": "Input Leap", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.0.3"}], "platforms": ["Windows", "MacOS"], "defaultStatus": "unknown"}], "references": [{"url": "https://github.com/input-leap/input-leap/blob/v3.0.3/src/lib/inputleap/DragInformation.cpp", "tags": ["technical-description", "product"]}, {"url": "https://github.com/input-leap/input-leap/blob/master/src/lib/inputleap/DropHelper.cpp", "tags": ["technical-description", "product"]}, {"url": "https://raw.githubusercontent.com/input-leap/input-leap/v3.0.3/src/lib/server/Server.cpp", "tags": ["technical-description", "product"]}, {"url": "https://raw.githubusercontent.com/input-leap/input-leap/master/src/lib/inputleap/ArgParser.cpp", "tags": ["technical-description", "product"]}, {"url": "https://raw.githubusercontent.com/input-leap/input-leap/master/src/lib/net/SecureSocket.cpp", "tags": ["technical-description", "product"]}, {"url": "https://github.com/input-leap/input-leap/releases", "tags": ["product"]}, {"url": "https://raw.githubusercontent.com/debauchee/barrier/master/src/lib/barrier/DragInformation.cpp", "tags": ["technical-description", "related"]}, {"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-42072", "tags": ["vdb-entry", "related"]}, {"url": "https://github.com/deskflow/deskflow/security/advisories", "tags": ["related"]}, {"url": "https://www.openwall.com/lists/oss-security/2026/09/25/4", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}, "descriptions": [{"lang": "en", "value": "Input Leap (aka input-leap) through 3.0.3, when the non-default --enable-drag-drop option is used on Windows or macOS, mishandles the / versus \\ distinction and allows directory traversal, with resultant code execution if a file is written to a startup directory. This occurs via a DDRG message."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-180", "description": "CWE-180 Incorrect Behavior Order: Validate Before Canonicalize"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-09-25T15:35:14.634Z"}}}, "cveMetadata": {"cveId": "CVE-2026-100230", "state": "PUBLISHED", "dateUpdated": "2026-09-25T16:09:08.291Z", "dateReserved": "2026-09-25T15:31:52.007Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-09-25T15:31:52.421Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "platforms": ["Windows", "MacOS"], "product": "Input Leap", "vendor": "input-leap", "versions": [{"lessThanOrEqual": "3.0.3", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "cve@mitre.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Input Leap (aka input-leap) through 3.0.3, when the non-default --enable-drag-drop option is used on Windows or macOS, mishandles the / versus \\ distinction and allows directory traversal, with resultant code execution if a file is written to a startup directory. This occurs via a DDRG message."}], "id": "CVE-2026-100230", "lastModified": "2026-09-30T17:32:07.107", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 3.6, "source": "cve@mitre.org", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-100230", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-09-25T16:08:59.786693Z", "version": "2.0.3"}}]}, "published": "2026-09-25T16:17:24.657", "references": [{"source": "cve@mitre.org", "url": "https://github.com/deskflow/deskflow/security/advisories"}, {"source": "cve@mitre.org", "url": "https://github.com/input-leap/input-leap/blob/master/src/lib/inputleap/DropHelper.cpp"}, {"source": "cve@mitre.org", "url": "https://github.com/input-leap/input-leap/blob/v3.0.3/src/lib/inputleap/DragInformation.cpp"}, {"source": "cve@mitre.org", "url": "https://github.com/input-leap/input-leap/releases"}, {"source": "cve@mitre.org", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-42072"}, {"source": "cve@mitre.org", "url": "https://raw.githubusercontent.com/debauchee/barrier/master/src/lib/barrier/DragInformation.cpp"}, {"source": "cve@mitre.org", "url": "https://raw.githubusercontent.com/input-leap/input-leap/master/src/lib/inputleap/ArgParser.cpp"}, {"source": "cve@mitre.org", "url": "https://raw.githubusercontent.com/input-leap/input-leap/master/src/lib/net/SecureSocket.cpp"}, {"source": "cve@mitre.org", "url": "https://raw.githubusercontent.com/input-leap/input-leap/v3.0.3/src/lib/server/Server.cpp"}, {"source": "cve@mitre.org", "url": "https://www.openwall.com/lists/oss-security/2026/09/25/4"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-180"}], "source": "cve@mitre.org", "type": "Secondary"}]}

{"bugzilla": {"description": "input-leap: input-leap: Arbitrary code execution via path traversal in drag-and-drop file transfer", "id": "2541482", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2541482"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N", "status": "draft"}, "cwe": "CWE-22", "details": ["Input Leap (aka input-leap) through 3.0.3, when the non-default --enable-drag-drop option is used on Windows or macOS, mishandles the / versus \\ distinction and allows directory traversal, with resultant code execution if a file is written to a startup directory. This occurs via a DDRG message.", "A flaw was found in Input Leap. When the drag-and-drop file transfer feature is enabled, a connected peer can exploit improper path validation to perform directory traversal. By sending a specially crafted file transfer message, an attacker can write arbitrary files outside the intended destination directory, potentially leading to arbitrary code execution."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2026-100230", "public_date": "2026-09-25T15:31:52Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-100230\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-100230\nhttps://github.com/deskflow/deskflow/security/advisories\nhttps://github.com/input-leap/input-leap/blob/master/src/lib/inputleap/DropHelper.cpp\nhttps://github.com/input-leap/input-leap/blob/v3.0.3/src/lib/inputleap/DragInformation.cpp\nhttps://github.com/input-leap/input-leap/releases\nhttps://nvd.nist.gov/vuln/detail/CVE-2021-42072\nhttps://raw.githubusercontent.com/debauchee/barrier/master/src/lib/barrier/DragInformation.cpp\nhttps://raw.githubusercontent.com/input-leap/input-leap/master/src/lib/inputleap/ArgParser.cpp\nhttps://raw.githubusercontent.com/input-leap/input-leap/master/src/lib/net/SecureSocket.cpp\nhttps://raw.githubusercontent.com/input-leap/input-leap/v3.0.3/src/lib/server/Server.cpp\nhttps://www.openwall.com/lists/oss-security/2026/09/25/4"], "statement": "This issue does not affect Red Hat products. The input-leap package is only available in Fedora community repositories, and the vulnerability only affects Windows and macOS targets. On Linux, the argument parser refuses the --enable-drag-drop flag, so the vulnerable drag-and-drop file transfer code path cannot be activated. The Fedora community affect is set to NOTAFFECTED accordingly.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": ["windows", "macos"], "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.0.3]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Input Leap", "source": "cna", "vendor": "input-leap"}, "product": "input_leap", "vendor": "input-leap"}], "created": "2026-09-25T19:00:15.523809+00:00", "updated": "2026-09-30T05:45:17.396533+00:00", "vendors": ["input-leap", "input-leap$PRODUCT$input_leap"]}