Executive brief
RapidRAW, a photo processing application, contains a vulnerability that can leak a user's Windows login credentials. By tricking a user into importing a malicious preset file or viewing a compromised community preset, the application can be forced to connect to an attacker's server. This connection automatically transmits the user's NTLMv2 credentials, which can be used to impersonate the user or gain unauthorized access to their network.
Technical details
A path traversal/external control of file name vulnerability (CWE-73) exists in RapidRAW's LUT (Look-Up Table) processing logic. The application passes the 'lutPath' field from preset files directly to File::open() in lut_processing.rs without validation. On Windows, an attacker can supply a UNC path (e.g., \\attacker-host\share) which forces the OS to initiate an outbound SMB connection, leaking the victim's NTLMv2 hashes. This can be triggered via two vectors: automatically when a user browses the 'Community' tab (if the remote repository is compromised) or manually when a user imports a malicious preset file. The issue is fixed in version 1.6.0 by explicitly blocking paths starting with UNC or network prefixes.
Affected products
- CyberTimon RapidRAW before 1.6.0
Timeline
- 2026-07-26: patched: Version 1.6.0 released with fix
- 2026-07-30: disclosed: Vulnerability advisory published by VulnCheck