Legcord: Path traversal in theme IPC handlers
Summary
Legcord versions 1.1.0 through 1.3.0, a third-party desktop client for Discord, contain a path traversal flaw in the theme IPC handlers. Unvalidated theme IDs let script running in the Discord page escape the themes directory. An attacker with such script, for example via a Discord XSS flaw or a malicious mod or plugin, can launch local executables, recursively delete directories and write files outside the themes folder.
Affected
- Legcord 1.1.0 through 1.3.0 (per CNA VulnCheck; default configuration unaffected)
Fixed in
- Legcord v1.3.1 (vendor release notes state that v1.3.1 fixes this CVE and CVE-2026-105294)
Workaround
- Unknown. No workaround is documented in the sources; upgrading to v1.3.1 or newer is the documented remedy.
Exploitation
- No in-the-wild exploitation reported. CISA SSVC: Exploitation none, Automatable no, Technical Impact total. CISA KEV: not listed.
- No public proof-of-concept found.
- An unverified GitHub issue report attributes an account compromise to the sibling CVE-2026-105294, not to this CVE; not confirmed by the vendor.
Our recommendation
- Inventory Legcord and other unofficial Discord clients on endpoints.
- Update Legcord to v1.3.1 or newer, or remove it where not needed.
- Remove unapproved clients and unofficial themes or mods from managed and BYOD devices.
- Check your package source for the fixed version, as distribution packages may lag behind.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulnCheck advisory www.vulncheck.com
- OSV record CVE-2026-105293 osv.dev
- Legcord releases github.com
- Legcord GitHub repository github.com
- Affected code: themes.ts (v1.3.0) github.com
- Affected code: ipc.ts (v1.3.0) github.com
- Legcord issue 1163 github.com
- Legcord issue 1174 github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 04:54.
Original description (NVD)
Legcord 1.1.0 through 1.3.0 contains a path traversal vulnerability in theme IPC handlers that allows script in the Discord page to escape the themes directory via unvalidated theme ids. Attackers running script in the Discord origin, such as through XSS, can abuse themes.folder, themes.uninstall, and themes.install to launch local executables, recursively delete directories, and write files outside the themes directory.
NVD references (5)
- https://github.com/Legcord/Legcord
- https://github.com/Legcord/Legcord/blob/v1.3.0/src/common/themes.ts#L269-L276
- https://github.com/Legcord/Legcord/blob/v1.3.0/src/discord/ipc.ts#L201-L206
- https://github.com/Legcord/Legcord/issues/1163
- https://www.vulncheck.com/advisories/legcord-1.1.0-through-1.3.0-path-traversal-via-theme-ipc-handlers
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.