Executive brief
Detect-It-Easy is a utility used by developers and security researchers to identify file types and analyze software. A vulnerability in how the tool handles compressed archives allows a malicious file to write data to sensitive locations on a user's computer. If an attacker successfully exploits this, they could gain persistent control over the system by overwriting startup scripts or other critical files.
Technical details
A path traversal vulnerability (CWE-23) exists in Detect-It-Easy versions prior to 3.21 due to insufficient path normalization during archive extraction. The flaw is located within the archive handling components (XArchive and Formats), where the application fails to validate that extracted file paths remain within the intended destination directory. An attacker can exploit this by crafting an archive containing entries with relative traversal sequences (e.g., ../) or absolute paths. When a user opens and extracts such a malicious archive, the tool may overwrite arbitrary files on the local filesystem, potentially leading to persistent code execution if startup scripts or system binaries are replaced. The issue is resolved in version 3.21.
Affected products
- horsicq Detect-It-Easy < 3.21
Timeline
- 2026-04-21: patched: Version 3.21 released with security fixes
- 2026-05-04: disclosed: Initial disclosure and CVE assignment
- 2026-05-04: advisory: VulnCheck advisory published
References
- https://github.com/horsicq/DIE-engine/commit/7fd300b926daf19707b2a36f0abe8b60a51308ee
- https://github.com/horsicq/DIE-engine/commit/cbbe1688e58ffd430d284bf65f336973f083db69
- https://github.com/horsicq/DIE-engine/releases/tag/3.21
- https://github.com/horsicq/Detect-It-Easy
- https://github.com/horsicq/Formats/commit/56cdf50ee3c72c56284e2819b23e98332842d259
- https://github.com/horsicq/XArchive/commit/6a2aa84c2fd120b704f76bb5c5ee3e9b5a7a0fcc
- https://www.vulncheck.com/advisories/detect-it-easy-path-traversal-arbitrary-file-write