Path Traversal in Tauri Download Command Allows Arbitrary File Write

Pake before 3.13.1 joins the JavaScript-supplied filename for the download_file Tauri command onto the user's Downloads directory with no sanitization. A filename containing path traversal sequences (for example ../Library/LaunchAgents/com.evil.plist) or an absolute path resolves outside ~/Downloads. The command then fetches attacker-controlled content from the supplied URL (via Rust HTTP, not the browser) and writes it to that path. A script that can invoke the command can overwrite user-writable files and install persistence (macOS LaunchAgents, Linux autostart, Windows Startup), leading to code execution in the user account. All desktop apps generated from an affected Pake tree expose the same command.

Casky was already ahead

This CVE exploits attack patterns that Casky's 351matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

Pake versions before 3.13.1 contain a critical path traversal vulnerability in the download_file Tauri command that fails to sanitize user-supplied filenames. This allows attackers to write arbitrary files to any location on the user's filesystem by crafting malicious filenames containing directory traversal sequences (../../../) or absolute paths. An attacker who can invoke this command—through a compromised web application, malicious script, or social engineering—can overwrite critical system files, inject malicious executables, or plant persistence mechanisms like LaunchAgents on macOS. This affects any application built with Pake that exposes the download_file functionality, particularly impacting users who interact with untrusted web content or applications with weak input validation.

Casky's 351 mapped skills enable detection of the attack patterns underlying this vulnerability by analyzing both the execution flow and file system modifications associated with MITRE ATT&CK techniques TA0001 (Initial Access) and TA0007 (Discovery/Defense Evasion). Practitioners using Claude AI with extended reasoning would observe several critical indicators: suspicious download_file invocations with path traversal payloads in command arguments, unexpected file writes outside standard application directories, modifications to sensitive locations like LaunchAgents or system startup folders, and HTTP requests from Tauri processes directly to attacker-controlled domains. The skill mapping enables detection of Defense Evasion (T1027) through obfuscated path sequences, Persistence (T1547) when files are written to auto-launch directories, and Command and Control patterns when downloads originate from external attacker infrastructure—allowing security teams to identify exploitation attempts before files reach disk or achieve persistence.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

351 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-82635.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0007

Investigate the attack patterns behind CVE-2026-82635

Casky has 351 skills that investigate the attack patterns behind CVE-2026-82635. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn