Path Traversal Vulnerability in better-auth better-icons by Better Auth
CVE-2026-15527

4.8MEDIUM

Key Information:

Vendor: Better-auth
Status: Better-icons
Vendor: CVE Published:; 13 July 2026

🔔 Create Better-auth Vulnerability Alert

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-15527?

A vulnerability exists in the better-auth better-icons component, specifically in the scan_project_icons/sync_icon function, which is subject to a path traversal attack. This vulnerability affects versions up to 1.0.5 and can be exploited locally by manipulating the icons_file argument. Although the issue has been disclosed publicly, the project maintainers have not yet addressed the problem despite being previously informed through an issued report. Users should take precautionary measures to safeguard their systems against potential exploitation.

Affected Version(s)

better-icons 1.0.0

better-icons 1.0.1

better-icons 1.0.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-15527 - Proof of Concept