Is CVE-2026-59683 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-59683 being exploited in the wild.

How severe is CVE-2026-59683?

Critical severity, with a CVSS score of 9.8, published 26 August 2026.

Which products and versions are affected?

Adam Honse OpenRGB prior to rc3 (August 2026).

Is there a fix for CVE-2026-59683?

A patch was published on 2026-08-12: Fix applied in release_candidate_1.0rc3 (commit d2dd9dcc) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-59683 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-59683?

Check whether you run Adam Honse OpenRGB at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-59683: OpenRGB network protocol arbitrary file write via attacker-controlled strings

CVE-2026-59683 · Severity: critical · CVSS 9.8 · Published 2026-08-26

OpenRGB is a lighting control utility that communicates via a network protocol. An attacker can exploit a path traversal flaw in this protocol to write arbitrary content to any file location on the system. If the OpenRGB daemon runs as root or with elevated privileges, this enables complete system compromise; if running as a regular user, it allows full account takeover through file manipulation (e.g., modifying shell configuration files or SSH keys).

Technologies: Adam Honse OpenRGB. Vendors: Adam Honse.

Quick answers

Is CVE-2026-59683 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-59683 being exploited in the wild.
How severe is CVE-2026-59683?: Critical severity, with a CVSS score of 9.8, published 26 August 2026.
Which products and versions are affected?: Adam Honse OpenRGB prior to rc3 (August 2026).
Is there a fix for CVE-2026-59683?: A patch was published on 2026-08-12: Fix applied in release_candidate_1.0rc3 (commit d2dd9dcc) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-59683 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-59683?: Check whether you run Adam Honse OpenRGB at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a path traversal and arbitrary file write flaw in OpenRGB's network protocol handler. The root cause is insufficient input validation on user-supplied profile names and file paths passed through the network protocol, allowing attackers to inject path traversal sequences (e.g., "../") to write files outside intended directories. The attack is network-accessible if the daemon is exposed (originally bound to 0.0.0.0, though the fix changes the default to 127.0.0.1), and requires no authentication. Attackers can write attacker-controlled strings to arbitrary filesystem paths, enabling code execution, privilege escalation, or account compromise depending on daemon privilege level. The fix (commit d2dd9dcc, August 2026) introduces a make_filename() function to sanitize profile names by removing dangerous characters and path traversal sequences before filesystem operations.

Affected products

Adam Honse OpenRGB prior to rc3 (August 2026)

Timeline

2026-08-26: disclosed: CVE-2026-59683 published on NVD
2026-08-12: patched: Fix applied in release_candidate_1.0rc3 (commit d2dd9dcc)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.