Pake before 3.13.1 joins the JavaScript-supplied filename for the download_file Tauri command onto the user's Downloads directory with no sanitization.
CVSS 3.1HIGH 8.8·Network·No auth·User interaction·EPSS 0.0063·Published 2026-08-30·Fixed in 3.13.1CWE-22