CVE-2026-66050 Details

A path traversal vulnerability has been identified in NitroShare Desktop versions through 0.3.4. This vulnerability exists in the application's LAN file transfer server, which operates without authentication on all network interfaces via port 40818. The issue allows unauthenticated attackers on the same network to write arbitrary files by sending a crafted filename that includes directory traversal sequences in the JSON item header name field. The server fails to validate the file paths, enabling attackers to write files outside the designated transfer root directory to any location where the current user has write permissions. This includes the Windows Startup folder, where malicious files could be executed automatically on the next user login.

Users are advised to update to a version of NitroShare Desktop that addresses this vulnerability. As of now, no specific patched version has been released. However, users can manually implement some suggested remediation steps, such as sanitizing received filenames to remove path separators and `..` sequences, and enabling TLS by default.