{"schema":"threatline.record/2","record":{"id":"CVE-2026-100230","aliases":[],"summary":"Input Leap (aka input-leap) through 3.0.3, when the non-default --enable-drag-drop option is used on Windows or macOS, mishandles the / versus \\ distinction and allows directory traversal, with result","details":"Input Leap (aka input-leap) through 3.0.3, when the non-default --enable-drag-drop option is used on Windows or macOS, mishandles the / versus \\ distinction and allows directory traversal, with resultant code execution if a file is written to a startup directory. This occurs via a DDRG message.","categories":["Unclassified"],"product":"Input Leap","vendor":"input-leap","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100230","source_modified_at":"2026-09-25T16:09:08.291Z","fetched_at":"2026-10-23T18:52:38.922436Z","product":"Input Leap","vendor":"input-leap","versions":[{"lessThanOrEqual":"3.0.3","status":"affected","version":"0","versionType":"semver"}],"defaultStatus":"unknown"}],"fixed_versions":[],"cvss":5.3,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00652,"percentile":0.50641,"score_date":"2026-10-23"},"published_at":"2026-09-25T15:31:52.421Z","modified_at":"2026-09-25T16:09:08.291Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-100230","fetched_at":"2026-10-23T18:52:38.922436Z","source_modified_at":"2026-09-25T16:09:08.291Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-100230","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/input-leap/input-leap/blob/v3.0.3/src/lib/inputleap/DragInformation.cpp","tags":["technical-description","product"]},{"source":"CVE List","url":"https://github.com/input-leap/input-leap/blob/master/src/lib/inputleap/DropHelper.cpp","tags":["technical-description","product"]},{"source":"CVE List","url":"https://raw.githubusercontent.com/input-leap/input-leap/v3.0.3/src/lib/server/Server.cpp","tags":["technical-description","product"]},{"source":"CVE List","url":"https://raw.githubusercontent.com/input-leap/input-leap/master/src/lib/inputleap/ArgParser.cpp","tags":["technical-description","product"]},{"source":"CVE List","url":"https://raw.githubusercontent.com/input-leap/input-leap/master/src/lib/net/SecureSocket.cpp","tags":["technical-description","product"]},{"source":"CVE List","url":"https://github.com/input-leap/input-leap/releases","tags":["product"]},{"source":"CVE List","url":"https://raw.githubusercontent.com/debauchee/barrier/master/src/lib/barrier/DragInformation.cpp","tags":["technical-description","related"]},{"source":"CVE List","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-42072","tags":["vdb-entry","related"]},{"source":"CVE List","url":"https://github.com/deskflow/deskflow/security/advisories","tags":["related"]},{"source":"CVE List","url":"https://www.openwall.com/lists/oss-security/2026/09/25/4","tags":["third-party-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","assessed_at":"2026-09-25T16:08:59.786693Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-09-25T16:09:08.291Z","content_hash":"5e87963427055e6e428f878e3da692625ed731d46bf55d8eb3c8b1e63cfde1f1"}}