Read the docs
TI-2026-13066 Aliases CVE-2026-15527GHSA-2gq8-477v-cpgh

better-auth better-icons scan_project_icons/sync_icon path traversal

Priority MEDIUM 55CWE-22Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
Low · Low · Low
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

A vulnerability has been found in better-auth better-icons up to 1.0.5. This vulnerability affects unknown code of the component scan_project_icons/sync_icon. Such manipulation of the argument icons_file leads to path traversal. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00172 6th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
better-authbetter-icons1.0.0; 1.0.1; 1.0.2; 1.0.3; 1.0.4; 1.0.5—No fix listedCNA
  • better-icons Vendorbetter-auth Affected 1.0.0; 1.0.1; 1.0.2; 1.0.3; 1.0.4; 1.0.5 Fixed in — No fix listed CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:better-auth:better-icons:*:*:*:*:*:*:*:*——better-auth
  • cpe:2.3:a:better-auth:better-icons:*:*:*:*:*:*:*:* Versions — — ·better-auth

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-15527
  2. 2026-10-03 Alias added: GHSA-2gq8-477v-cpgh

References

Exploit 1

Other 1

  • TI-2025-38277 Better Auth: Unauthenticated API key creation through api-key plugin CVSS 4.0CRITICAL 9.3
  • TI-2026-47627 better-auth SCIM 1.5.0 before 1.7.0-beta.4 Authorization Bypass CVSS 4.0HIGH 8.7
  • TI-2025-20000 Beter Auth has an Open Redirect via Scheme-Less Callback Parameter CVSS 4.0MEDIUM 6.9
  • TI-2026-79320 OAuth state accepted as Magic Link token in Better Auth CVSS 3.1CRITICAL 9.1
  • TI-2026-74552 Authentication bypass in Better Auth Magic Link verification CVSS 4.0CRITICAL 9.3
  • TI-2026-84923 Unchecked state signing in @better-auth/expo enables account takeover CVSS 3.1CRITICAL 9.1
See all 39 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences