Vulnerability in Input-Leap Input Leap
CVE-2026-100230
Input Leap (aka input-leap) through 3.0.3, when the non-default --enable-drag-drop option is used on Windows or macOS, mishandles the / versus \ distinction and allows directory traversal, with resultant code execution if a file is written to a startup directory. This occurs via a DDRG message.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
Weakness classification (CWE)
References
- github.com/input-leap/input-leap/blob/v3.0.3/src/lib/inputleap/DragInformation… (product, technical-description)
- github.com/input-leap/input-leap/blob/master/src/lib/inputleap/DropHelper.cpp (product, technical-description)
- raw.githubusercontent.com/input-leap/input-leap/v3.0.3/src/lib/server/Server.cpp (product, technical-description)
- raw.githubusercontent.com/input-leap/input-leap/master/src/lib/inputleap/ArgPar… (product, technical-description)
- raw.githubusercontent.com/input-leap/input-leap/master/src/lib/net/SecureSocket… (product, technical-description)
- github.com/input-leap/input-leap/releases (product)
- raw.githubusercontent.com/debauchee/barrier/master/src/lib/barrier/DragInformat… (related, technical-description)
- nvd.nist.gov/vuln/detail/CVE-2021-42072 (related, vdb-entry)
- github.com/deskflow/deskflow/security/advisories (related)
- www.openwall.com/lists/oss-security/2026/09/25/4 (third-party-advisory)
Frequently asked questions
- What is CVE-2026-100230?
- CVE-2026-100230 is a medium-severity vulnerability in Input-Leap Input Leap, classified under CWE-180. CVSS score: 5.3/10. Published 2026-09-25.
- How severe is CVE-2026-100230?
- Medium severity. CVSS v3 base score is 5.3 out of 10.