CVE-2026-106103

Quasar Framework: Path Traversal / Arbitrary File Write via crafted Icon Genie profile

HIGH 7.1

En bref

Source: NVD
EPSS: EPSS 0.29 % · centile 21 (2026-10-28)
État: PUBLISHED
Publiée: 2026-10-06 17:11 UTC
Mise à jour: 2026-10-06 19:42 UTC
Attribuée par: GitHub_M
Statut NVD: Awaiting Analysis

Description

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/icongenie 6.1.1, the icongenie generate --profile command accepted folder and name values from a user-supplied profile without constraining the resolved destination to the Quasar project directory. icongenie/lib/utils/get-assets-files.js joined those values with appDir, while icongenie/lib/utils/validate-profile-object.js required only non-empty strings, allowing parent-directory traversal. A developer who runs a crafted profile can cause generated image content to be written or overwritten at any path writable by that user, potentially modifying shell startup files, build scripts, or other executable configuration. This issue is fixed in version 6.1.1.

Faiblesses (CWE)

CWE-22 — Traversée de répertoire
CWE-73

Références

Scores

Version	Score	Vecteur	Évalué par
CVSS 3.1	HIGH 7.1	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H	GitHub_M
CVSS 3.1	HIGH 7.1	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H	NVD · security-advisories@github.com (Secondary)

Avis

GHSA-wmpw-j6qv-mw88 — Quasar Framework: Path Traversal / Arbitrary File Write via crafted Icon Genie profile

Références européennes

ENISA EUVD · EUVD-2026-93568
GCVE · GCVE-0-2026-106103

Produits affectés

Produit	Versions
quasarframework · quasar	affected < 2.22.0
@quasar · icongenie	affected < 6.1.1

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD