CVE-2026-100230Input Leap (aka input-leap) through 3.0.3, when the non-default --enable-drag-drop option is used on Windows or macOS, mishandles the / versus \ distinction and allows directory traversal, with resul…
Updated under an hour ago ()
Does this affect you?
It affects input-leap Input Leap. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
Input Leap (aka input-leap) through 3.0.3, when the non-default --enable-drag-drop option is used on Windows or macOS, mishandles the / versus \ distinction and allows directory traversal, with resultant code execution if a file is written to a startup directory. This occurs via a DDRG message.
- CVSS
- 5.3 MEDIUM (v3.1, CNA)CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
- Weakness (CWE)
- CWE-180
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- mitre
- NVD analysis
- Deferred
- Record last updated
- Sep 25, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
input-leap Input Leap input_leap:input_leap (from the name) | through 3.0.3 | CNA record |
References
- https://github.com/input-leap/input-leap/blob/v3.0.3/src/lib/inputleap/DragInformation.cpptechnical-description, product
- https://github.com/input-leap/input-leap/blob/master/src/lib/inputleap/DropHelper.cpptechnical-description, product
- https://raw.githubusercontent.com/input-leap/input-leap/v3.0.3/src/lib/server/Server.cpptechnical-description, product
- https://raw.githubusercontent.com/input-leap/input-leap/master/src/lib/inputleap/ArgParser.cpptechnical-description, product
- https://raw.githubusercontent.com/input-leap/input-leap/master/src/lib/net/SecureSocket.cpptechnical-description, product
- https://github.com/input-leap/input-leap/releasesproduct
- https://raw.githubusercontent.com/debauchee/barrier/master/src/lib/barrier/DragInformation.cpptechnical-description, related
- https://nvd.nist.gov/vuln/detail/CVE-2021-42072vdb-entry, related
- https://github.com/deskflow/deskflow/security/advisoriesrelated
- https://www.openwall.com/lists/oss-security/2026/09/25/4third-party-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.