A critical path traversal vulnerability in Pake allows unauthenticated attackers to write arbitrary files to a system, potentially leading to remote code execution.

The vulnerability exists due to insufficient sanitization of the filename parameter in the download_file Tauri command. An unauthenticated attacker can supply path traversal sequences or absolute paths to escape the intended directory and overwrite sensitive files.

Successful exploitation allows an attacker to write arbitrary files to the victim's filesystem, which can be used to install persistence mechanisms like macOS LaunchAgents or Windows Startup items. This facilitates remote code execution within the context of the user account, leading to full compromise of the user's data and system access. With a CVSS score of 8.8, this vulnerability represents a high risk to organizational security and data integrity.

Immediate Action: Upgrade Pake to version 3.13.1 or later and rebuild all desktop applications generated from the affected Pake tree.

Proactive Monitoring: Monitor system logs for unexpected file creation events in sensitive directories and track the execution of new or unknown processes related to startup items.

Compensating Controls: Implement endpoint protection solutions that restrict unauthorized file writes to system directories and monitor for anomalous HTTP requests originating from Pake-generated applications.

Public Exploit Available: Unknown.

The ability for an attacker to bypass directory restrictions and write files to arbitrary locations poses a severe threat to end-user systems. Administrators and developers must prioritize upgrading to version 3.13.1 immediately to implement the required filename sanitization. Failure to rebuild existing applications will leave them vulnerable despite the underlying framework update.