Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilityhigh

Input Leap 3.0.3 advisories cover path traversal and Windows escalation

1 source · 2 articlesFirst reported Updated ()3 · 2 reads
What's new

First coverage.

Merged summary · grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Two NotCVE advisories say Input Leap through 3.0.3 allows peer writes outside the drop directory and local Windows commands as SYSTEM.

Two Full Disclosure advisories published on 2026-09-27 describe separate flaws in Input Leap through version 3.0.3. NotCVE-2026-0014 says drag-and-drop file transfer does not properly limit pathnames, so a connected peer can write a file outside the configured drop-target directory in version 3.0.3. NotCVE-2026-0015 says the input-leapd daemon lacks authentication for a critical IPC function through 3.0.3, allowing a local low-privileged Windows user to run arbitrary commands as NT AUTHORITY\SYSTEM. The reports do not disagree; they cover different issues. Neither advisory cites a CVE or reports exploitation in the wild, and NotCVE-2026-0015 is described as not a CVE identifier.

Key facts
  • NotCVE-2026-0014 covers improper pathname limitation in Input Leap 3.0.3 drag-and-drop file transfer.
  • A connected peer can write a file outside the configured drop-target directory.
  • NotCVE-2026-0015 covers missing authentication on a critical IPC function in input-leapd through version 3.0.3.
  • On Windows, a local low-privileged user can execute arbitrary commands as NT AUTHORITY\SYSTEM via the unauthenticated IPC interface.
  • Neither advisory assigns a CVE identifier; NotCVE-2026-0015 is explicitly not a CVE, and neither report says the issues are being exploited.
  • Both Full Disclosure posts are dated 2026-09-27.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
Products
Input Leapinput-leapd

Coverage

oldest first · one row per article · UTC
  1. · Sep 27, 2026 Full DisclosureFirst report

    [NotCVE-2026-0014] Input Leap 3.0.3 Drag-and-Drop File Transfer Path Traversal Allows Arbitrary File Write Outside the Drop Directory

    Input Leap 3.0.3 path traversal lets a connected peer write files outside the drop directory.

  2. · Sep 27, 2026 Full Disclosure

    [NotCVE-2026-0015] Input Leap through 3.0.3 input-leapd Unauthenticated IPC Command Execution Allows Local Privilege Escalation to SYSTEM

    Input Leap through 3.0.3 lets a local Windows user run commands as SYSTEM via unauthenticated IPC.