CVE-2025-24888

🗓️ 13 Feb 2025 17:32:38Reported by GitHub_MType

Potential code execution on SecureDrop Client prior to version 0.14.1 from malicious server.

Reporter	Title	Published	Views	Family All 11
ATTACKERKB	CVE-2026-35465	18 Apr 202600:41	–	attackerkb
Circl	CVE-2025-24888	13 Feb 202517:37	–	circl
CNNVD	SecureDrop 路径遍历漏洞	13 Feb 202500:00	–	cnnvd
Cvelist	CVE-2025-24888 Path traversal in SecureDrop Client API.download_reply()	13 Feb 202517:32	–	cvelist
EUVD	EUVD-2025-3974	3 Oct 202520:07	–	euvd
EUVD	EUVD-2026-23626	18 Apr 202600:41	–	euvd
NVD	CVE-2025-24888	13 Feb 202518:18	–	nvd
OSV	CVE-2025-24888 Path traversal in SecureDrop Client API.download_reply()	13 Feb 202517:32	–	osv
Positive Technologies	PT-2025-7041 · Unknown · Securedrop Client	13 Feb 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-24888	15 Feb 202518:21	–	redhatcve

Vulners

Node

freedomofpress securedrop-clientRange<0.14.1

[
  {
    "vendor": "freedomofpress",
    "product": "securedrop-client",
    "versions": [
      {
        "version": "< 0.14.1",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/freedomofpress/securedrop-client/security/advisories/GHSA-6c3p-chq6-q3j2
github	www.github.com/freedomofpress/securedrop-client/blob/main/client/securedrop_client/api_jobs/downloads.py
github	www.github.com/freedomofpress/securedrop-client/blob/release/0.14.0/client/securedrop_client/sdk/__init__.py
qubes-os	www.qubes-os.org/doc/split-gpg
github	www.github.com/freedomofpress/securedrop-client/commit/120bac14649db0bcf5f24f2eb82731c76843b1ba
github	www.github.com/freedomofpress/securedrop-client/blob/0.14.0/client/securedrop_client/utils.py

15 Apr 2026 00:35Current

8.2High risk

Vulners AI Score8.2

CVSS 3.18.1

EPSS0.0307

SSVC

CWE-22