Read the docs
TI-2026-68623 Aliases CVE-2026-106103GHSA-wmpw-j6qv-mw88

Path traversal in Quasar icongenie lets crafted profiles write files

Priority LOW 31CWE-22Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

Quasar Framework before 2.22.0 and @quasar/icongenie before 6.1.1 are affected. The generate --profile command accepts folder and name values without restricting the resolved destination to the project directory, which enables path traversal (CWE-22). If a developer runs a crafted profile, generated image content can be written or overwritten at any path that user can write, potentially including shell startup files or build scripts.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/icongenie 6.1.1, the icongenie generate --profile command accepted folder and name values from a user-supplied profile without constraining the resolved destination to the Quasar project directory. icongenie/lib/utils/get-assets-files.js joined those values with appDir, while icongenie/lib/utils/validate-profile-object.js required only non-empty strings, allowing parent-directory traversal. A developer who runs a crafted profile can cause generated image content to be written or overwritten at any path writable by that user, potentially modifying shell startup files, build scripts, or other executable configuration. This issue is fixed in version 6.1.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00285 21st percentileScored 2026-11-07
Fix Fixed quasar (quasarframework): 2.22.0icongenie (@quasar): 6.1.1+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
quasarframeworkquasarbefore 2.22.02.22.0Patch availableCNA
@quasaricongeniebefore 6.1.16.1.1Patch availableCNA
—@quasar/icongenie (npm)before 6.1.16.1.1Patch availableGHSA-wmpw-j6qv-mw88
  • quasar Vendorquasarframework Affected before 2.22.0 Fixed in 2.22.0 Patch available CNA
  • icongenie Vendor@quasar Affected before 6.1.1 Fixed in 6.1.1 Patch available CNA
  • @quasar/icongenie (npm) Vendor— Affected before 6.1.1 Fixed in 6.1.1 Patch available GHSA-wmpw-j6qv-mw88

Remediation

Upgrade @quasar/icongenie to version 6.1.1. The sources list no fixed version for quasar.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA quasar (quasarframework) Fixed in 2.22.0
  • Fix · CNA icongenie (@quasar) Fixed in 6.1.1
  • Fix · GHSA-wmpw-j6qv-mw88 @quasar/icongenie (npm) Fixed in 6.1.1 Advisory →

Timeline

  1. 2026-10-06 Threatist record created from CVE-2026-106103
  2. 2026-10-07 CISA SSVC decision points changed
  3. 2026-10-07 Priority changed: MEDIUM → LOW
  4. 2026-10-07 Alias added: GHSA-wmpw-j6qv-mw88
  5. 2026-10-07 Fix available: npm/@quasar/[email protected] · GHSA-wmpw-j6qv-mw88
  6. 2026-10-07 CVSS score added · GHSA-wmpw-j6qv-mw88
  7. 2026-10-07 Weakness changed · GHSA-wmpw-j6qv-mw88
  8. 2026-10-07 5 new references · GHSA-wmpw-j6qv-mw88

References

Advisory 1

Other 4

  • TI-2026-68624 Regex backtracking on User-Agent header stalls Quasar SSR servers CVSS 4.0HIGH 8.7
  • TI-2026-68626 Quasar SSR dev error page leaks environment secrets and enables XSS CVSS 4.0HIGH 7.1
  • TI-2026-51731 Quasar Framework: Prototype pollution in Quasar extend() utility CVSS 3.1MEDIUM 5.6
  • TI-2026-68622 Cross-site scripting in Quasar Framework SSR meta tags CVSS 3.1CRITICAL 10.0
  • TI-2026-68621 Type confusion in quasarframework quasar CVSS 3.1LOW 3.1
  • TI-2026-68625 Quasar caches development TLS keys with lax file permissions CVSS 4.0HIGH 8.4
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences