CVE-2026-66050
NitroShare Desktop 0.3.4 Path Traversal via LAN File Transfer Server
CVSS Score
7.5
EPSS Score
0.0%
EPSS Percentile
0th
NitroShare Desktop through 0.3.4 contains a path traversal vulnerability in its LAN file transfer server that allows unauthenticated attackers on the same network to write arbitrary files by sending a crafted filename containing directory traversal sequences in the JSON item header name field. Attackers can exploit the lack of path validation to write files outside the transfer root directory to arbitrary locations the current user has write access, including the Windows Startup folder, enabling persistent code execution on the next user login.
| CWE | CWE-22 |
| Vendor | nitroshare |
| Product | nitroshare-desktop |
| Published | Jul 27, 2026 |
Stay Ahead of the Next One
Get instant alerts for nitroshare nitroshare-desktop
Be the first to know when new high vulnerabilities affecting nitroshare nitroshare-desktop are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None
Affected Versions
nitroshare / nitroshare-desktop
0 ≤ 0.3.4
References
Credits
Christopher Duram