LM Studio model downloader path traversal lets a crafted model repository write files outside the models directory

LM Studio's resolveDownloadRequest fails to normalize backslash-separated traversal filenames, allowing an attacker-controlled model repository to land files outside the models folder. The patch shipped in LM Studio 0.4.22 (build 1).

Local LLM runtimes are a tempting target because users trust model repositories as binary artifacts. A traversal write outside the models directory can stage a file the user executes or overwrite config, turning a 'just download a model' action into code execution on a machine that also holds the user's prompts and any local API keys.

The model downloader resolves a requested model's path and trusts backslash-separated traversal segments in the filename. An attacker who tricks a user into downloading a crafted model repository (or a malicious registry entry) can write arbitrary files outside the models directory on the host.

LM Studio before 0.4.22+1 (fixed in the 0.4.22 build), specifically the model downloader's resolveDownloadRequest.

Upgrade to LM Studio 0.4.22+1.