CVE-2026-15527

MEDIUM 5.3

better-auth better-icons scan_project_icons/sync_icon path traversal

CVSS Score

5.3

EPSS Score

0.1%

EPSS Percentile

4th

A vulnerability has been found in better-auth better-icons up to 1.0.5. This vulnerability affects unknown code of the component scan_project_icons/sync_icon. Such manipulation of the argument icons_file leads to path traversal. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CWE	CWE-22
Vendor	better-auth
Product	better-icons
Published	Jul 13, 2026
Last Updated	Jul 13, 2026

Stay Ahead of the Next One

Get instant alerts for better-auth better-icons

Be the first to know when new medium vulnerabilities affecting better-auth better-icons are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

better-auth / better-icons

1.0.0 1.0.1 1.0.2 1.0.3 1.0.4 1.0.5

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/377865 vuldb.com: https://vuldb.com/vuln/377865/cti vuldb.com: https://vuldb.com/cve/CVE-2026-15527 vuldb.com: https://vuldb.com/submit/854530 github.com: https://github.com/better-auth/better-icons/issues/18 github.com: https://github.com/better-auth/better-icons/

Credits

🔍 Mcfly_Zhang (VulDB User) VulDB CNA Team