Vulnerability · Published Oct 5, 2026 · Assigned by VulnCheck

CVE-2026-105293Legcord 1.1.0 through 1.3.0 Path Traversal via Theme IPC Handlers

High 8.1

In plain English

A high-severity path traversal in Legcord from Legcord. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.4%top 68.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Legcord 1.1.0 through 1.3.0 contains a path traversal vulnerability in theme IPC handlers that allows script in the Discord page to escape the themes directory via unvalidated theme ids. Attackers running script in the Discord origin, such as through XSS, can abuse themes.folder, themes.uninstall, and themes.install to launch local executables, recursively delete directories, and write files outside the themes directory.

Affected products (as reported)

Vendor	Product	Versions
Legcord	Legcord	1.1.0 – through 1.3.0

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References

GitHub Issue #1163 issue-tracking
https://github.com/Legcord/Legcord product
https://github.com/Legcord/Legcord/blob/v1.3.0/src/discord/ipc.ts#L201-L206 technical-description
https://github.com/Legcord/Legcord/blob/v1.3.0/src/common/themes.ts#L269-L276 technical-description
VulnCheck Advisory: Legcord 1.1.0 through 1.3.0 Path Traversal via Theme IPC Handlers third-party-advisory