CVE-2026-22685

DevToys is a desktop app for developers. In versions from 2.0.0.0 to before 2.0.9.0, a path traversal vulnerability exists in the DevToys extension installation mechanism. When processing extension packages (NUPKG archives), DevToys does not sufficiently validate file paths contained within the archive. A malicious extension package could include crafted file entries such as ../../…/target-file, causing the extraction process to write files outside the intended extensions directory. This flaw enables an attacker to overwrite arbitrary files on the user’s system with the privileges of the DevToys process. Depending on the environment, this may lead to code execution, configuration tampering, or corruption of application or system files. This issue has been patched in version 2.0.9.0.

• CWE-22

• https://github.com/DevToys-app/DevToys/commit/02fb7d46d9c663a4ee6ed968baa6a8810405047fPatch
• https://github.com/DevToys-app/DevToys/pull/1643Issue Tracking, Patch
• https://github.com/DevToys-app/DevToys/security/advisories/GHSA-ggxr-h6fm-p2qhVendor Advisory

Published

Jan 10, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-22678Webmin before 2.641 contains a stored cross-site scripting v…5.4
• CVE-2026-22679Weaver (Fanwei) E-cology 10.0 versions prior to 20260312 con…9.8
• CVE-2026-2268The Ninja Forms plugin for WordPress is vulnerable to Sensit…7.5
• CVE-2026-22680OpenViking versions prior to 0.3.3 contain a missing authori…6.9
• CVE-2026-22682OpenHarness prior to commit 166fcfe contains an improper acc…8.4
• CVE-2026-22683Windmill versions 1.56.0 through 1.614.0 contain a missing a…8.8
• CVE-2026-22686Enclave is a secure JavaScript sandbox designed for safe AI …10
• CVE-2026-22687WeKnora is an LLM-powered framework designed for deep docume…9.8
• CVE-2026-22688WeKnora is an LLM-powered framework designed for deep docume…8.8
• CVE-2026-22689Mailpit is an email testing tool and API for developers. Pri…6.5
• CVE-2026-2269The Uncanny Automator – Easy Automation, Integration, Webhoo…7.2
• CVE-2026-22690pypdf is a free and open-source pure-python PDF library. Pri…5.3