The image-downloader component at version 4.3.0 contains a path traversal flaw that allows an attacker controlling the download URL to cause the downloaded response data to be written outside the configured destination directory. This vulnerability effectively permits the attacker to write arbitrary files on the host where the downloader runs, enabling modification of critical files, injection of malicious code, or other integrity and confidentiality violations. The weakness is identified as a Path Traversal (CWE‑22).

The affected product is the open‑source image-downloader project maintained by demsking. Version 4.3.0 is vulnerable. The fix is included in v4.3.1 and later releases. No other versions are listed as affected in the available CNA data.

The CVSS score of 9.1 classifies the vulnerability as high severity. No EPSS value is published, but the absence of an EPSS entry does not reduce the inherent risk. The vulnerability is not listed in the CISA KEV catalog, indicating no publicly known exploitation at the time of reporting. The likely attack vector is remote exploitation via crafted download URLs supplied to the application, requiring no authentication. An attacker who can supply a malicious URL can cause the downloader to write files to arbitrary locations, potentially overwriting application or system code. Because the attacker controls the download URL, the exploitation is straightforward for a remote attacker with network access to the downloader service. The combination of high severity, remote exploitation potential, and lack of mitigation makes immediate action necessary.