GCVE-1988-2026-0389

Vulnerability from gna-1988 – Published: 2026-10-02 04:57 – Updated: 2026-10-02 04:57
VLAI
Title
[NotCVE-2026-0014] Input Leap 3.0.3 Drag-and-Drop File Transfer Path Traversal Allows Arbitrary File Write Outside the Drop Directory
Summary
---------------------------------------------------------------------------- NotCVE Advisory — NotCVE-2026-0014 ---------------------------------------------------------------------------- [-] Summary: Improper limitation of a pathname in the drag-and-drop file transfer feature of Input Leap, the open-source keyboard and mouse sharing tool, allows a connected peer to write a file outside the configured drop-target directory. Writing into the per-user Startup folder turns this into code execution as the receiving user at the next login. CVSS:3.1 5.3 (AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N). [-] Affected: Input Leap through 3.0.3 (the final release) and master, on Windows and macOS. The input-leap/input-leap repository was archived read-only on 26 July 2026; no fixed version exists or is expected. [-] Technical Description: DragInformation::parseDragInfo() in src/lib/inputleap/DragInformation.cpp reduces each received filename to its basename. It picks one separator for the whole received blob ('/' if the data contains a '/' anywhere, otherwise '\') and then locates the last separator at or before each entry's comma: findResult2 = data.find_last_of(slash, findResult1); ... if (findResult1 - findResult2 > 1) { auto filename = data.substr(findResult2 + 1, findResult1 - findResult2 - 1); find_last_of() returns std::string::npos when no separator is present, and that value is never tested. The unsigned arithmetic wraps: findResult2 + 1 becomes 0, the guard still passes, and the call degrades to data.substr(0, findResult1) - the whole attacker-supplied string up to the comma, with any ".." sequences intact. Because the separator is chosen once per blob, a peer can force the mismatch: a single stray '/' after the first comma selects '/', while a filename written with '\' separators contains no '/' before that comma. DropHelper::writeToDir() in src/lib/inputleap/DropHelper.cpp appends the result to the drop-target directory and opens it for writing, with no normalisation, no check for ".." or absolute prefixes, and no check that the path stays beneath the drop target. A name such as ..\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ escapes the configured folder, and a file written there runs as the receiving user at the next login. Preconditions: the feature is opt-in (--enable-drag-drop, not the default), and ArgParser refuses the flag on Linux, so only Windows and macOS targets are affected. Both directions are reachable (malicious client against a server, malicious server against a client). Under the default ENCRYPTED_AUTHENTICATED level the sender must already be a paired peer; a target started with --disable-crypto has no such requirement. The same unchecked find_last_of() result is present in the ancestor debauchee/barrier codebase. The sibling fork Deskflow removed drag-and-drop file transfer and does not appear to carry this code path. Weaknesses: CWE-22: Improper Limitation of a Pathname to a Restricted Directory CWE-191: Integer Underflow (Wrap or Wraparound) CAPEC-126: Path Traversal CAPEC-139: Relative Path Traversal [-] Credit: Discovered by Christopher Duram (https://www.linkedin.com/in/christopherduram/). [-] Full Details and Updates: https://notcve.org/notcve/NotCVE-2026-0014 [-] Main References: https://github.com/input-leap/input-leap https://github.com/input-leap/input-leap/blob/v3.0.3/src/lib/inputleap/DragInformation.cpp [-] About NotCVE: NotCVE (https://notcve.org) assigns public, timestamped NotCVE IDs to vulnerabilities not acknowledged by vendors. Vendor will not assign a CVE? Request a NotCVE: https://notcve.org/form/ · Contributors: https://notcve.org/hall/ _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
CWE
Assigner
VULNARCHIVE GNA GNA-1988
GNA scorecard E 38/100 over 445 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
unknown Input Leap Affected: unknown
guessed Create a notification for this product.
Credits
advisories
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Input Leap",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "advisories"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "----------------------------------------------------------------------------\nNotCVE Advisory \u2014 NotCVE-2026-0014\n----------------------------------------------------------------------------\n\n[-] Summary:\nImproper limitation of a pathname in the drag-and-drop file transfer\nfeature of Input Leap, the open-source keyboard and mouse sharing tool,\nallows a connected peer to write a file outside the configured drop-target\ndirectory. Writing into the per-user Startup folder turns this into code\nexecution as the receiving user at the next login. CVSS:3.1 5.3\n(AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N).\n\n[-] Affected:\nInput Leap through 3.0.3 (the final release) and master, on Windows and\nmacOS. The input-leap/input-leap repository was archived read-only on\n26 July 2026; no fixed version exists or is expected.\n\n[-] Technical Description:\nDragInformation::parseDragInfo() in src/lib/inputleap/DragInformation.cpp\nreduces each received filename to its basename. It picks one separator for\nthe whole received blob (\u0027/\u0027 if the data contains a \u0027/\u0027 anywhere, otherwise\n\u0027\\\u0027) and then locates the last separator at or before each entry\u0027s comma:\n\n  findResult2 = data.find_last_of(slash, findResult1);\n  ...\n  if (findResult1 - findResult2 \u003e 1) {\n      auto filename = data.substr(findResult2 + 1,\n                                  findResult1 - findResult2 - 1);\n\nfind_last_of() returns std::string::npos when no separator is present, and\nthat value is never tested. The unsigned arithmetic wraps: findResult2 + 1\nbecomes 0, the guard still passes, and the call degrades to\ndata.substr(0, findResult1) - the whole attacker-supplied string up to the\ncomma, with any \"..\" sequences intact.\n\nBecause the separator is chosen once per blob, a peer can force the\nmismatch: a single stray \u0027/\u0027 after the first comma selects \u0027/\u0027, while a\nfilename written with \u0027\\\u0027 separators contains no \u0027/\u0027 before that comma.\n\nDropHelper::writeToDir() in src/lib/inputleap/DropHelper.cpp appends the\nresult to the drop-target directory and opens it for writing, with no\nnormalisation, no check for \"..\" or absolute prefixes, and no check that\nthe path stays beneath the drop target. A name such as\n..\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ escapes\nthe configured folder, and a file written there runs as the receiving user\nat the next login.\n\nPreconditions: the feature is opt-in (--enable-drag-drop, not the\ndefault), and ArgParser refuses the flag on Linux, so only Windows and\nmacOS targets are affected. Both directions are reachable (malicious\nclient against a server, malicious server against a client). Under the\ndefault ENCRYPTED_AUTHENTICATED level the sender must already be a paired\npeer; a target started with --disable-crypto has no such requirement.\n\nThe same unchecked find_last_of() result is present in the ancestor\ndebauchee/barrier codebase. The sibling fork Deskflow removed drag-and-drop\nfile transfer and does not appear to carry this code path.\n\nWeaknesses:\nCWE-22: Improper Limitation of a Pathname to a Restricted Directory\nCWE-191: Integer Underflow (Wrap or Wraparound)\nCAPEC-126: Path Traversal\nCAPEC-139: Relative Path Traversal\n\n[-] Credit:\nDiscovered by Christopher Duram\n(https://www.linkedin.com/in/christopherduram/).\n\n[-] Full Details and Updates:\nhttps://notcve.org/notcve/NotCVE-2026-0014\n\n[-] Main References:\nhttps://github.com/input-leap/input-leap\nhttps://github.com/input-leap/input-leap/blob/v3.0.3/src/lib/inputleap/DragInformation.cpp\n\n[-] About NotCVE:\nNotCVE (https://notcve.org) assigns public, timestamped NotCVE IDs to\nvulnerabilities not acknowledged by vendors. Vendor will not assign a CVE?\nRequest a NotCVE: https://notcve.org/form/ \u00b7 Contributors:\nhttps://notcve.org/hall/\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-191",
              "description": "CWE-191",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-22",
              "description": "CWE-22",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-02T04:57:26Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/67"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Sep/67"
        },
        {
          "url": "https://github.com/input-leap/input-leap"
        },
        {
          "url": "https://github.com/input-leap/input-leap/blob/v3.0.3/src/lib/inputleap/DragInformation.cpp"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://notcve.org"
        },
        {
          "url": "https://notcve.org/form/"
        },
        {
          "url": "https://notcve.org/hall/"
        },
        {
          "url": "https://notcve.org/notcve/NotCVE-2026-0014"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.linkedin.com/in/christopherduram/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Sep/67"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[NotCVE-2026-0014] Input Leap 3.0.3 Drag-and-Drop File Transfer Path Traversal Allows Arbitrary File Write Outside the Drop Directory",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0389",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/67",
            "automated": true,
            "contentSha256": "eef29a444ff1983adf3b6e2aff80da54644b68e28ab6ade228df090afd1a5e2b",
            "evidenceScore": 8,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/67",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-09-25T09:00:49Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-10-02T04:57:26Z",
    "dateUpdated": "2026-10-02T04:57:26Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0389"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.