Path Traversal Vulnerability in HBAI-Ltd Toonflow App

CVE-2026-7085

What is CVE-2026-7085?

A vulnerability exists in the HBAI-Ltd Toonflow-app affecting the z.url functionality in the downloadApp endpoint, which can be exploited to achieve path traversal. This flaw allows an attacker to potentially manipulate the URL parameter exploited remotely. The complexity of this attack is high due to the nature of the exploit, which has been publicly disclosed, although actual exploitation remains in question according to the vendor's response. Notably, the relevant update URL is hardcoded in the official repository, limiting the scope of possible exploitation unless the code is altered by users.

References