CVE-2026-22685

{
  "id": "CVE-2026-22685",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-22685",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-01-12T14:39:22.248923Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "DevToys-app",
          "product": "DevToys",
          "versions": [
            {
              "status": "affected",
              "version": ">= 2.0.0.0, < 2.0.9.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-01-10T06:15:51.743",
  "references": [
    {
      "url": "https://github.com/DevToys-app/DevToys/commit/02fb7d46d9c663a4ee6ed968baa6a8810405047f",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/DevToys-app/DevToys/pull/1643",
      "tags": [
        "Issue Tracking",
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/DevToys-app/DevToys/security/advisories/GHSA-ggxr-h6fm-p2qh",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "DevToys is a desktop app for developers. In versions from 2.0.0.0 to before 2.0.9.0, a path traversal vulnerability exists in the DevToys extension installation mechanism. When processing extension packages (NUPKG archives), DevToys does not sufficiently validate file paths contained within the archive. A malicious extension package could include crafted file entries such as ../../…/target-file, causing the extraction process to write files outside the intended extensions directory. This flaw enables an attacker to overwrite arbitrary files on the user’s system with the privileges of the DevToys process. Depending on the environment, this may lead to code execution, configuration tampering, or corruption of application or system files. This issue has been patched in version 2.0.9.0."
    },
    {
      "lang": "es",
      "value": "DevToys es una aplicación de escritorio para desarrolladores. En versiones desde la 2.0.0.0 hasta antes de la 2.0.9.0, existe una vulnerabilidad de salto de ruta en el mecanismo de instalación de extensiones de DevToys. Al procesar paquetes de extensiones (archivos NUPKG), DevToys no valida suficientemente las rutas de archivo contenidas dentro del archivo. Un paquete de extensión malicioso podría incluir entradas de archivo manipuladas como ../../…/target-file, haciendo que el proceso de extracción escriba archivos fuera del directorio de extensiones previsto. Esta falla permite a un atacante sobrescribir archivos arbitrarios en el sistema del usuario con los privilegios del proceso de DevToys. Dependiendo del entorno, esto puede llevar a la ejecución de código, la manipulación de la configuración o la corrupción de archivos de aplicación o del sistema. Este problema ha sido parcheado en la versión 2.0.9.0."
    }
  ],
  "lastModified": "2026-06-17T10:20:13.887",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:devtoys:devtoys:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1E05DD68-AE09-4AC6-9496-27EE7C537F64",
              "versionEndExcluding": "2.0.9.0",
              "versionStartIncluding": "2.0.1.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}