CVE-2026-15527

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-15527

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-15527.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-15527

Published

2026-07-13T03:00:08.811Z

Modified

2026-07-16T03:31:17.553329528Z

Severity

1.9 (Low) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

better-auth better-icons scan_project_icons/sync_icon path traversal

Details

A vulnerability has been found in better-auth better-icons up to 1.0.5. This vulnerability affects unknown code of the component scanprojecticons/syncicon. Such manipulation of the argument iconsfile leads to path traversal. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/15xxx/CVE-2026-15527.json",
    "cwe_ids": [
        "CWE-22"
    ],
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "1.0.0"
                },
                {
                    "last_affected": "1.0.0"
                },
                {
                    "introduced": "1.0.1"
                },
                {
                    "last_affected": "1.0.1"
                },
                {
                    "introduced": "1.0.2"
                },
                {
                    "last_affected": "1.0.2"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ],
    "cna_assigner": "VulDB"
}

References

Affected packages

Git / github.com/better-auth/better-icons

Affected ranges

Type

GIT

Repo

https://github.com/better-auth/better-icons

Events

Introduced

26dbd57ffc02a66440c3800f61ef8f0c79c28e77

Last affected

8faf8a65ea6fa9e144f39b0117f0d72b4fba9c12

Database specific

{
    "extracted_events": [
        {
            "introduced": "1.0.3"
        },
        {
            "last_affected": "1.0.3"
        },
        {
            "introduced": "1.0.4"
        },
        {
            "last_affected": "1.0.4"
        },
        {
            "introduced": "1.0.5"
        },
        {
            "last_affected": "1.0.5"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

1.*

1.0.3

1.0.4

1.0.5

v1.*

v1.0.3

v1.0.4

v1.0.5

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-15527.json"