Description
Detect-It-Easy prior to 3.21 contains a path traversal vulnerability that allows attackers to write arbitrary files to the filesystem by crafting malicious archive entries with relative traversal sequences or absolute paths. Attackers can exploit insufficient path normalization during archive extraction to write files outside the intended extraction directory and achieve persistent code execution by overwriting user startup scripts.
Affected products
horsicq: detect-it-easy
References7
- github.com/horsicq/DIE-engine/commit/7fd300b926daf19707b2a36f0a… Patch
- github.com/horsicq/DIE-engine/commit/cbbe1688e58ffd430d284bf65f… Patch
- github.com/horsicq/Formats/commit/56cdf50ee3c72c56284e2819b23e9… Patch
- github.com/horsicq/XArchive/commit/6a2aa84c2fd120b704f76bb5c5ee… Patch
- github.com/horsicq/DIE-engine/releases/tag/3.21 Release Notes
- github.com/horsicq/Detect-It-Easy Product
- www.vulncheck.com/advisories/detect-it-easy-path-traversal-arbi… Third Party Advisory
Metrics
- CVSS 3.1
-
7.8
HIGH
Score source: NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 4.0
-
6.8
MEDIUM
Score source: CNA
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - EPSS — exploit probability
- 0% percentile: 6 · as of 13 November 2026
- CWE
- CWE-23
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.