Raw vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2026-43616 is a medium-severity Relative Path Traversal (CWE-23) vulnerability in Horsicq Detect-It-Easy. Its CVSS base score is 6.8 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and AC-3 (Access Enforcement) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
Detect-It-Easy versions prior to 3.21 are affected by CVE-2026-43616, a path traversal vulnerability (CWE-23) stemming from insufficient path normalization during archive extraction. This flaw enables attackers to write arbitrary files to the filesystem by crafting malicious archive entries that include relative traversal sequences or absolute paths, allowing files to be placed outside the intended extraction directory.
The vulnerability has a CVSS v3.1 base score of 7.1 (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H), indicating it requires local access, low attack complexity, no privileges, and user interaction for exploitation. A local attacker can trick a user into processing a malicious archive within Detect-It-Easy, resulting in arbitrary file writes that enable persistent code execution, such as by overwriting user startup scripts.
Mitigation is provided in Detect-It-Easy version 3.21, available at https://github.com/horsicq/DIE-engine/releases/tag/3.21. Relevant fixes include commits https://github.com/horsicq/DIE-engine/commit/7fd300b926daf19707b2a36f0abe8b60a51308ee and https://github.com/horsicq/DIE-engine/commit/cbbe1688e58ffd430d284bf65f336973f083db69 in the DIE-engine repository, as well as https://github.com/horsicq/Formats/commit/56cdf50ee3c72c56284e2819b23e98332842d259 in the Formats repository. Additional details are in the Detect-It-Easy repository at https://github.com/horsicq/Detect-It-Easy.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-27081
Vulnerability Data
Detect-It-Easy prior to 3.21 contains a path traversal vulnerability that allows attackers to write arbitrary files to the filesystem by crafting malicious archive entries with relative traversal sequences or absolute paths. Attackers can exploit insufficient path normalization during archive extraction…
more
to write files outside the intended extraction directory and achieve persistent code execution by overwriting user startup scripts.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V5.3.2
Mitigating Controls (NIST 800-53 r5) AI
Explicit validation of path inputs stops .. sequences from ever being interpreted by the file system.
Access enforcement directly blocks unauthorized file reads/writes that result from unresolved .. sequences.
Information-flow rules can be configured to reject traversals that would move data outside an approved directory boundary.
Least privilege reduces the set of reachable files even when a traversal succeeds.
Secure-engineering principles require safe pathname construction and input neutralization before any file operation.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require input validation and path sanitization that prevent relative traversal.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development catches path traversal via static/dynamic analysis, but does not itself implement the fix.
Secure development lifecycle mandates input validation and path-handling controls that directly prevent relative path traversal.
Application security requirements explicitly call for controls against path traversal and other injection flaws.
Secure architecture principles include directory isolation and canonicalization, reducing but not eliminating traversal risk.
Secure coding standards require neutralizing path traversal sequences, directly addressing CWE-23.
Information access restriction limits which files can be reached, mitigating impact but not preventing the traversal flaw.