Quasar Framework: Path Traversal / Arbitrary File Write via crafted Icon Genie profile

published 2026-10-06 34 d ago modified 2026-10-07 33 d ago also GHSA-wmpw-j6qv-mw88 , EUVD-2026-93568

cvss: 7.1; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 21%
public exploits: 0; none known

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/icongenie 6.1.1, the icongenie generate --profile command accepted folder and name values from a user-supplied profile without constraining the resolved destination to the Quasar project directory. icongenie/lib/utils/get-assets-files.js joined those values with appDir, while icongenie/lib/utils/validate-profile-object.js required only non-empty strings, allowing parent-directory traversal. A developer who runs a crafted profile can cause generated image content to be written or overwritten at any path writable by that user, potentially modifying shell startup files, build scripts, or other executable configuration. This issue is fixed in version 6.1.1.

Patch / fix

fixed in 1 links 2

npm @quasar/icongenie 6.1.1

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 33 d ago (2026-10-06)

Exploit prediction

0.29% chance of exploitation in the next 30 days, higher than 21% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	7.1	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
GitHub	3.1	7.1	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Affected packages

ecosystem	package	affected	fixed in
npm	@quasar/icongenie	<6.1.1	6.1.1

Affected products

quasarframework quasar
@quasar icongenie

Classification

Weakness

CWE-22 Improper Limitation of a Pathname to a Restricted Directory
CWE-73 External Control of File Name or Path

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary