EUVD-2025-3974

🗓️ 03 Oct 2025 20:07:09Reported by EUVDType

SecureDrop Client vulnerability allows code execution via malicious filename handling before v0.14.1

Reporter	Title	Published	Views	Family All 11
ATTACKERKB	CVE-2026-35465	18 Apr 202600:41	–	attackerkb
Circl	CVE-2025-24888	13 Feb 202517:37	–	circl
CNNVD	SecureDrop 路径遍历漏洞	13 Feb 202500:00	–	cnnvd
CVE	CVE-2025-24888	13 Feb 202517:32	–	cve
Cvelist	CVE-2025-24888 Path traversal in SecureDrop Client API.download_reply()	13 Feb 202517:32	–	cvelist
EUVD	EUVD-2026-23626	18 Apr 202600:41	–	euvd
NVD	CVE-2025-24888	13 Feb 202518:18	–	nvd
OSV	CVE-2025-24888 Path traversal in SecureDrop Client API.download_reply()	13 Feb 202517:32	–	osv
Positive Technologies	PT-2025-7041 · Unknown · Securedrop Client	13 Feb 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-24888	15 Feb 202518:21	–	redhatcve

[
  {
    "enisaIdVendor": [
      {
        "id": "930bf6c3-3c6f-338c-baf8-ddccc81c0c0c",
        "vendor": {
          "name": "freedomofpress"
        }
      }
    ],
    "enisaIdProduct": [
      {
        "id": "ce0f3274-b14f-3f8b-86ab-2040ec005ee2",
        "product": {
          "name": "securedrop-client"
        },
        "product_version": "< 0.14.1"
      }
    ]
  }
]

Source	Link
github	www.github.com/freedomofpress/securedrop-client/security/advisories/GHSA-6c3p-chq6-q3j2
github	www.github.com/freedomofpress/securedrop-client/commit/120bac14649db0bcf5f24f2eb82731c76843b1ba
github	www.github.com/freedomofpress/securedrop-client/blob/0.14.0/client/securedrop_client/utils.py
github	www.github.com/freedomofpress/securedrop-client/blob/main/client/securedrop_client/api_jobs/downloads.py
github	www.github.com/freedomofpress/securedrop-client/blob/release/0.14.0/client/securedrop_client/sdk/__init__.py
qubes-os	www.qubes-os.org/doc/split-gpg

03 Oct 2025 20:07Current

6.5Medium risk

Vulners AI Score6.5

CVSS 3.18.1

EPSS0.0307

SSVC