Demsking - Image-downloader - CRITICAL - CVE-2026-103648. The Image-Downloader version 4.3.0 contains a path traversal vulnerability that allows an attacker with control over the download URL to manipulate the application into writing downloaded response data outside of the designated directory. This could lead to unauthorized access to sensitive files within the server or filesystem, potentially compromising the integrity and confidentiality of the affected system. Users of this version are advised to take immediate action to mitigate risk.