Find a vulnerability

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "NitroShare Desktop",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "advisories"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "----------------------------------------------------------------------------\nNotCVE Advisory \u2014 NotCVE-2026-0009\n----------------------------------------------------------------------------\n\n[-] Summary:\nNitroShare Desktop 0.3.4 contains a path traversal vulnerability in its LAN\nfile transfer receive path. The transfer service is reachable from the local\nnetwork on TCP port 40818 and processes incoming transfer metadata without\nauthentication in the reported default configuration. A LAN-adjacent attacker\ncan write attacker-controlled file content outside the intended download\ndirectory. CVSS:3.1 7.1 (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L).\n\n[-] Affected:\nNitroShare Desktop, versions through 0.3.4 (application).\nNo fixed version is currently verified.\n\n[-] Technical Description:\nWhen receiving a transfer, NitroShare parses sender-controlled JSON item\nmetadata, creates a receive-side filesystem item from that metadata, opens\nthe item for writing, and writes subsequent binary packet content to it.\n\nIn the filesystem plugin, the received item name is used as a relative\nfilename and combined with the configured transfer directory using\nQDir::cleanPath(root + QDir::separator() + mRelativeFilename), without a\nvisible check that the resolved path remains inside the transfer directory.\n\nAn attacker on the same local network can send a crafted transfer item name\ncontaining relative path traversal sequences such as ../, causing NitroShare\nto write received file content outside the intended download directory. The\nwrite is limited to locations accessible to the NitroShare process user. On\nWindows, writing to the current user\u0027s Startup folder can result in code\nexecution when the affected user next logs in.\n\nWeaknesses:\nCWE-22: Improper Limitation of a Pathname to a Restricted Directory\nCWE-35: Path Traversal: \u0027.../...//\u0027\nCAPEC-126: Path Traversal\n\nA proof-of-concept is published in the researcher\u0027s repository (see\nReferences).\n\n[-] Timeline:\n[12/04/2026] - CVE ID requested through the MITRE CVE request form; request\n               ignored, no CVE assigned.\n[22/07/2026] - NotCVE ID reserved.\n[23/07/2026] - Published as NotCVE-2026-0009.\n\n[-] Credit:\nDiscovered by Christopher Duram (https://github.com/cduram).\n\n[-] Full Details and Updates:\nhttps://notcve.org/notcve/NotCVE-2026-0009\n\n[-] References:\nhttps://github.com/cduram/NotCVE-2026-0009\nhttps://github.com/cduram/NotCVE-2026-0009/blob/main/poc_path_traversal.py\nhttps://github.com/nitroshare/nitroshare-desktop\nhttps://github.com/nitroshare/nitroshare-desktop/blob/master/libnitroshare/src/transfer/transfer.cpp\nhttps://github.com/nitroshare/nitroshare-desktop/blob/master/plugins/filesystem/file.cpp\nhttps://github.com/nitroshare/nitroshare-desktop/blob/master/plugins/filesystem/filehandler.cpp\n\n[-] About NotCVE:\nNotCVE (https://notcve.org) assigns public, timestamped NotCVE IDs to\nvulnerabilities not acknowledged by vendors. Vendor will not assign a CVE?\nRequest a NotCVE: https://notcve.org/form/ \u00b7 Contributors:\nhttps://notcve.org/hall/\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-35",
              "description": "CWE-35",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-07T13:20:22Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/110"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/110"
        },
        {
          "url": "https://github.com/cduram"
        },
        {
          "url": "https://github.com/cduram/NotCVE-2026-0009"
        },
        {
          "url": "https://github.com/cduram/NotCVE-2026-0009/blob/main/poc_path_traversal.py"
        },
        {
          "url": "https://github.com/nitroshare/nitroshare-desktop"
        },
        {
          "url": "https://github.com/nitroshare/nitroshare-desktop/blob/master/libnitroshare/src/transfer/transfer.cpp"
        },
        {
          "url": "https://github.com/nitroshare/nitroshare-desktop/blob/master/plugins/filesystem/file.cpp"
        },
        {
          "url": "https://github.com/nitroshare/nitroshare-desktop/blob/master/plugins/filesystem/filehandler.cpp"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://notcve.org"
        },
        {
          "url": "https://notcve.org/form/"
        },
        {
          "url": "https://notcve.org/hall/"
        },
        {
          "url": "https://notcve.org/notcve/NotCVE-2026-0009"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/110"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[NotCVE-2026-0009] NitroShare Desktop 0.3.4 Path Traversal Allows LAN-Adjacent Arbitrary File Write",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0153",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/110",
            "automated": true,
            "contentSha256": "c9f3fde7dcd9b8fb154f6cb2464f0764c7a069954c507359d4361214aaa738c0",
            "evidenceScore": 10,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/110",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-19T10:57:51Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-07T13:20:22Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0153"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}