A flaw was found in Input Leap. When the drag-and-drop file transfer feature is enabled, a connected peer can exploit improper path validation to perform directory traversal. By sending a specially crafted file transfer message, an attacker can write arbitrary files outside the intended destination directory, potentially leading to arbitrary code execution.
Last checked: 2026-09-30 19:21 UTC
No exploitation evidence · CISA Coordinator (Assessed 2026-09-25 16:08 UTC)
Fix evidence last checked: 2026-09-28 12:59 UTC