A path traversal vulnerability (CVE-2026-22685) exists in DevToys desktop app versions 2.0.0.0 to before 2.0.9.0. The vulnerability occurs in the extension installation mechanism when processing NUPKG archives. DevToys fails to properly validate file paths within extension packages, allowing malicious packages to include crafted file entries like ../../target-file. This enables attackers to write files outside the intended extensions directory and overwrite arbitrary files with DevToys process privileges. The flaw can lead to code execution, configuration tampering, or corruption of system files. The issue has been patched in version 2.0.9.0.