AIKIDO-2026-736029

TL;DR

The bundled desktop application auto-updater builds the local staging path for a downloaded installer from attacker-influenceable HTTP response header values such as the filename and ETag. These values are passed to filepath.Join without validation, so ../ sequences let a staged file be written outside the update staging directory, including the Windows Startup folder. An attacker able to control or intercept the update response can drop and later execute an arbitrary executable, and chaining it with the missing update signature check yields silent persistent code execution. The fix constrains the filename with safeUpdateFilename, hashes the ETag into a fixed staging subdirectory, and enforces ensurePathInDir so the resolved path cannot escape the staging directory.