PT-2026-104667
CVE-2026-105293
·
تاريخ النشر
2026-10-05
·
تاريخ التحديث
2026-10-06
الوصف من
CVSS 4.0
9.2
حرجةالمقاييسAV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions
Legcord versions 1.1.0 through 1.3.0
Description
Path traversal exists in theme IPC handlers, allowing scripts running in the Discord origin, such as through Cross-Site Scripting (XSS), to escape the themes directory. This occurs due to unvalidated theme IDs. Attackers can abuse the
themes.folder, themes.uninstall, and themes.install handlers to launch local executables, recursively delete directories, and write files outside the intended themes directory.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
قابلية الاستغلال
استغلال
التأثيرات
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾