DevToys, a desktop application for developers, has a path traversal flaw in its extension installation mechanism that allows the extraction of files outside the intended extensions directory. An attacker can craft a NUPKG archive containing paths such as ../../…/target-file; the program then writes these files using the privileges of the DevToys process. The vulnerability is identified as CWE-22 and can lead to a local overwrite of arbitrary files, potentially enabling code execution, configuration tampering, or system corruption if critical files are affected.

The flaw affects DevToys v2.0.0.0 through v2.0.8.0. Versions 2.0.9.0 and later contain a patch that validates paths during extraction and mitigates the issue.

The vulnerability carries a CVSS score of 8.8, indicating high severity. Its EPSS score is listed as <1%, reflecting a low probability of exploitation, yet it remains possible. It is not yet included in the CISA KEV catalog. The likely attack vector is a malicious extension package that a user explicitly installs or that is supplied through an untrusted source. An attacker who can deliver such a package has the opportunity to overwrite system or application files with the privileges of the DevToys process, which may lead to further compromise of the user machine.