Vulnerability in Input-Leap Input Leap
CVE-2026-100230
Input Leap (aka input-leap) through 3.0.3, when the non-default --enable-drag-drop option is used on Windows or macOS, mishandles the / versus \ distinction and allows directory traversal, with resultant code execution if a file is written to a startup directory. This occurs via a DDRG message.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N.
EPSS exploit prediction
EPSS: 0.007 (51.5th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 52nd percentile — 51.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.007 · newest: 0.007 · change: 0.000
Affected products
Weakness classification (CWE)
References
- github.com/input-leap/input-leap/blob/v3.0.3/src/lib/inputleap/DragInformation… (product, technical-description)
- github.com/input-leap/input-leap/blob/master/src/lib/inputleap/DropHelper.cpp (product, technical-description)
- raw.githubusercontent.com/input-leap/input-leap/v3.0.3/src/lib/server/Server.cpp (product, technical-description)
- raw.githubusercontent.com/input-leap/input-leap/master/src/lib/inputleap/ArgPar… (product, technical-description)
- raw.githubusercontent.com/input-leap/input-leap/master/src/lib/net/SecureSocket… (product, technical-description)
- github.com/input-leap/input-leap/releases (product)
- raw.githubusercontent.com/debauchee/barrier/master/src/lib/barrier/DragInformat… (related, technical-description)
- nvd.nist.gov/vuln/detail/CVE-2021-42072 (related, vdb-entry)
- github.com/deskflow/deskflow/security/advisories (related)
- www.openwall.com/lists/oss-security/2026/09/25/4 (third-party-advisory)
Frequently asked questions
- What is CVE-2026-100230?
- CVE-2026-100230 is a medium-severity vulnerability in Input-Leap Input Leap, classified under CWE-180. CVSS score: 5.3/10. Published 2026-09-25.
- How severe is CVE-2026-100230?
- Medium severity. CVSS v3 base score is 5.3 out of 10.