Input Leap (aka input-leap) allows an attacker to perform directory traversal when the non-default --enable-drag-drop flag is enabled on Windows or macOS. The flaw occurs because the application incorrectly handles forward slash versus backslash characters in DDRG messages, enabling a crafted path to circumvent directory boundaries. If an attacker can supply a DDRG message that writes a file to a system startup directory, they can get that file executed at system boot, thereby compromising the integrity and confidentiality of the affected machine.

Input Leap versions 3.0.3 and earlier are impacted. All users who have enabled drag-and-drop support with the --enable-drag-drop option on Windows or macOS are at risk. The use of DDRG messages from external sources is required for exploitation, but the vendor does not identify additional sub-components beyond the core application.

The CVSS score of 5.3 indicates moderate severity. The EPSS score, listed as < 1%, reflects a very low probability of exploitation at the time of analysis. The vulnerability is not included in the CISA KEV catalog, meaning no known widespread exploitation or publicly available exploits are reported. Exploitation requires the attacker to trigger the DDRG message handling path while drag‑and‑drop is enabled; any entity able to send a crafted DDRG message with a malicious path may write an executable to a startup location, resulting in remote code execution.