image-downloader: Path traversal allows writes outside the destination directory

Summary

The Node.js library image-downloader, version 4.3.0 and according to the CNA earlier versions, lets files be written outside the configured destination directory. When filenames are derived from the URL path, an encoded parent-directory segment in the URL can redirect the downloaded response data to another location. An attacker can exploit this if the application passes URLs that they can influence and the process has write access to the target location. The CNA scores the issue at CVSS 9.1 (Critical), but the impact depends on the host application and filesystem permissions.

Affected

• image-downloader 4.3.0 (named in the CVE description)
• CNA range: all versions below 4.3.1 (default: unknown)
• OSV also lists 4.0.3 as affected (not yet verified)

Fixed in

• Version 4.3.1 (according to the CNA and the maintainer's npm profile)

Workaround

• No official workaround known.
• Interim measures until the update: do not pass user-supplied URLs to the download function, allow only trusted URLs, and restrict write access of the downloading process to its own image directory.

Exploitation

• No evidence of active exploitation in the wild.
• CISA SSVC: exploitation none, automatable yes, technical impact partial.
• Not listed in CISA KEV. A public proof of concept exists.

Our recommendation

• Find all projects that use image-downloader, including transitive dependencies in package.json and lockfiles.
• Update to version 4.3.1 or later.
• Prioritise services that download URLs from users or third parties.
• Restrict outbound URLs to an allowlist and limit write permissions of the process.
• Check the destination directories for unexpected files.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (1 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  EterNullSec/CVE-2026-103648

Research sources

• GitLab work item #32 (image-downloader) gitlab.com
• GitLab fix commit fb445430 gitlab.com
• CVE record via Vulners (CNA GitLab) vulners.com
• OSV entry CVE-2026-103648 osv.dev
• VulDB CVE-2026-103648 vuldb.com
• OpenCVE CVE-2026-103648 (CISA SSVC) app.opencve.io
• image-downloader on npm www.npmjs.com
• image-downloader GitHub mirror github.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 07:37.