Executive brief
NitroShare Desktop is a cross-platform tool used for sharing files between devices on a local network. A security flaw in its file transfer server allows an attacker on the same network to bypass security restrictions and save malicious files anywhere on a user's computer. This could allow an attacker to place a virus in the Windows Startup folder, leading to a full system takeover the next time the user logs in.
Technical details
A path traversal vulnerability (CWE-22) exists in the LAN file transfer server of NitroShare Desktop through version 0.3.4. The server, which listens on TCP port 40818, fails to validate the 'name' field within the JSON item header of incoming file transfers. An unauthenticated attacker on the same local network can use '../' sequences to escape the intended transfer root directory and write files to arbitrary locations with the permissions of the current user. By targeting sensitive locations such as the Windows Startup folder, an attacker can achieve persistent remote code execution. As of the advisory date, the developer has not responded to disclosure attempts, and no official patch is available.
Affected products
- NitroShare NitroShare Desktop through 0.3.4
Timeline
- 2026-04-13: other: Initial developer contact attempt
- 2026-07-27: disclosed: Public disclosure by VulnCheck
- 2026-07-27: advisory: NVD publication date