{"id":"CVE-2026-100230","revision":"f009762ec4f242e39ed4eae8ea30a9ff","records":[{"revision":"f009762ec4f242e39ed4eae8ea30a9ff","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-100230","aliases":[],"title":"Input Leap (aka input-leap) through 3.0.3, when the non-default --enable-drag-drop option is used on Windows or macOS, mishandles the / versus \\ distinction and allows directory traversal, with resultant code execution if a file is written …","description":"Input Leap (aka input-leap) through 3.0.3, when the non-default --enable-drag-drop option is used on Windows or macOS, mishandles the / versus \\ distinction and allows directory traversal, with resultant code execution if a file is written to a startup directory. This occurs via a DDRG message.","state":0,"publishedAt":"2026-09-25T15:31:52.421+00:00","modifiedAt":"2026-09-25T16:09:08.291+00:00","affected":[{"ecosystem":"Vendor product","name":"Input Leap","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"defaultStatus\": \"unknown\",\n                    \"platforms\": [\n                        \"Windows\",\n                        \"MacOS\"\n                    ],\n                    \"product\": \"Input Leap\",\n                    \"vendor\": \"input-leap\",\n                    \"versions\": [\n                        {\n                            \"lessThanOrEqual\": \"3.0.3\",\n                            \"status\": \"affected\",\n                            \"version\": \"0\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","score":5.3,"severity":"MEDIUM"}],"references":["https://github.com/input-leap/input-leap/blob/v3.0.3/src/lib/inputleap/DragInformation.cpp","https://github.com/input-leap/input-leap/blob/master/src/lib/inputleap/DropHelper.cpp","https://raw.githubusercontent.com/input-leap/input-leap/v3.0.3/src/lib/server/Server.cpp","https://raw.githubusercontent.com/input-leap/input-leap/master/src/lib/inputleap/ArgParser.cpp","https://raw.githubusercontent.com/input-leap/input-leap/master/src/lib/net/SecureSocket.cpp","https://github.com/input-leap/input-leap/releases","https://raw.githubusercontent.com/debauchee/barrier/master/src/lib/barrier/DragInformation.cpp","https://nvd.nist.gov/vuln/detail/CVE-2021-42072","https://github.com/deskflow/deskflow/security/advisories","https://www.openwall.com/lists/oss-security/2026/09/25/4"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-100230","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-100230","identifiers":["CVE-2026-100230"]},"retained":false,"historicalAffected":[]}],"coverage":[]}