CVE-2026-66050 Overview
CVE-2026-66050 is a path traversal vulnerability [CWE-22] in NitroShare Desktop versions through 0.3.4. The flaw resides in the Local Area Network (LAN) file transfer server, which fails to validate filenames supplied in the JSON item header name field. Unauthenticated attackers on the same network can send crafted transfers containing directory traversal sequences to write arbitrary files outside the intended transfer root. Because writes execute with the privileges of the current user, attackers can drop payloads into sensitive locations such as the Windows Startup folder to achieve persistent code execution on the next login.
Critical Impact
Network-adjacent attackers can write arbitrary files as the current user and establish persistence without authentication or user interaction.
Affected Products
- NitroShare Desktop versions through 0.3.4
- Windows installations of NitroShare exposing the LAN file transfer server
- Any host running NitroShare on a reachable network segment
Discovery Timeline
- 2026-07-27 - CVE-2026-66050 published to the National Vulnerability Database (NVD)
- 2026-07-28 - Last updated in NVD database
Technical Details for CVE-2026-66050
Vulnerability Analysis
NitroShare Desktop operates a file transfer service that listens on the local network and accepts incoming transfers using a custom protocol. Each transfer begins with a JSON header describing the item, including its name field. The server uses this attacker-controlled value directly when constructing the destination path on disk.
Because the server accepts unauthenticated connections from any peer on the LAN, an attacker requires only network reachability. The vulnerability produces integrity impact without requiring authentication, privileges, or user interaction.
Root Cause
The server does not sanitize or canonicalize the name value before joining it to the transfer root directory. Sequences such as ..\ or absolute path components pass through unfiltered. The resulting file path can escape the intended download directory and resolve to any location the running user can write.
Attack Vector
An attacker on the same broadcast domain sends a crafted transfer to the NitroShare listener. The JSON item header carries a name such as ..\..\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\payload.exe. The server writes the transferred bytes to that resolved path. On the next user login, Windows executes the dropped payload from the Startup folder, giving the attacker code execution in the user's session.
For technical details and proof-of-concept material, see the VulnCheck Security Advisory and the GitHub PoC Repository.
Detection Methods for CVE-2026-66050
Indicators of Compromise
- Unexpected executables or scripts appearing in %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\
- NitroShare transfer logs containing filenames with ..\, ../, or absolute path prefixes
- Inbound connections to the NitroShare listener port from unexpected LAN peers
- File writes by the NitroShare process to paths outside the configured transfer directory
Detection Strategies
- Monitor process file-write telemetry for NitroShare writing outside its configured download folder.
- Alert on new files created in user Startup folders by any non-installer process.
- Inspect network captures for NitroShare JSON headers where the name field contains traversal sequences.
Monitoring Recommendations
- Enable file integrity monitoring on Windows Startup directories and other autorun locations.
- Log and review all inbound connections on hosts running NitroShare, especially from untrusted network segments.
- Correlate NitroShare activity with subsequent process execution at user logon.
How to Mitigate CVE-2026-66050
Immediate Actions Required
- Stop or uninstall NitroShare Desktop on affected endpoints until a fixed version is available.
- Block the NitroShare listener port at the host firewall on untrusted networks.
- Audit Windows Startup folders and other autorun locations for unauthorized files.
- Restrict use of NitroShare to trusted, segmented networks only.
Patch Information
At the time of publication, no vendor patch is referenced in the NVD entry for versions above 0.3.4. Consult the VulnCheck Security Advisory for updates on remediation status and monitor the NitroShare project for a fixed release.
Workarounds
- Disable NitroShare when not actively transferring files.
- Run NitroShare only on isolated network segments where all peers are trusted.
- Apply host firewall rules to permit NitroShare traffic only from specific allowed IP addresses.
- Remove write permissions from the running user account for sensitive autorun paths where feasible.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
