CVE-2026-44225 Pulpy: Incomplete filesystem sandbox in pulpy.fs bridge allows packaged web apps to read arbitrary user files
Packaged web apps can bypass filesystem sandboxing to read and write arbitrary user files, including sensitive credentials.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-44225?
CVE-2026-44225 is a critical path traversal vulnerability in enesgkky Pulpy, published on 12 May 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Pulpy is a lightweight, cross-platform desktop application packager for web apps. Prior to 0.1.1, Pulpy injects a pulpy.fs JavaScript API into every packaged web application, giving it access to the host filesystem. A validateFsPath() function is supposed to sandbox this access, but its blocklist is incomplete. Any web app packaged with Pulpy can read and write arbitrary files in the user's home directory — including ~/.ssh/id_rsa, ~/.aws/credentials, and ~/Library/Keychains/. This vulnerability is fixed in 0.1.1.
Which versions are affected by CVE-2026-44225?
How do I fix CVE-2026-44225?
No fix has been published for CVE-2026-44225 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-44225 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-44225 exists.
Public exploit code: 1 Exploit-DB entry.