PT-2025-7041 · Unknown · Securedrop Client

🗓️ 13 Feb 2025 00:00:00Reported by Positive TechnologiesType

SecureDrop Client before 0.14.1 can execute code by writing an autostart file via manipulated Content-Disposition header.

Reporter	Title	Published	Views	Family All 11
ATTACKERKB	CVE-2026-35465	18 Apr 202600:41	–	attackerkb
Circl	CVE-2025-24888	13 Feb 202517:37	–	circl
CNNVD	SecureDrop 路径遍历漏洞	13 Feb 202500:00	–	cnnvd
CVE	CVE-2025-24888	13 Feb 202517:32	–	cve
Cvelist	CVE-2025-24888 Path traversal in SecureDrop Client API.download_reply()	13 Feb 202517:32	–	cvelist
EUVD	EUVD-2025-3974	3 Oct 202520:07	–	euvd
EUVD	EUVD-2026-23626	18 Apr 202600:41	–	euvd
NVD	CVE-2025-24888	13 Feb 202518:18	–	nvd
OSV	CVE-2025-24888 Path traversal in SecureDrop Client API.download_reply()	13 Feb 202517:32	–	osv
RedhatCVE	CVE-2025-24888	15 Feb 202518:21	–	redhatcve

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-24888
osv	www.osv.dev/vulnerability/CVE-2025-24888
github	www.github.com/freedomofpress/securedrop-client/security/advisories/GHSA-6c3p-chq6-q3j2
github	www.github.com/freedomofpress/securedrop-client/commit/120bac14649db0bcf5f24f2eb82731c76843b1ba
github	www.github.com/freedomofpress/securedrop-client/blob/release/0.14.0/client/securedrop_client/sdk/__init__.py
github	www.github.com/freedomofpress/securedrop-client/blob/0.14.0/client/securedrop_client/utils.py
github	www.github.com/freedomofpress/securedrop-client/blob/main/client/securedrop_client/api_jobs/downloads.py
twitter	www.twitter.com/CVEnew/status/1890150865996247323
twitter	www.twitter.com/cybercronai/status/1891367408264188284
t	www.t.me/cvedetector/18043

17 Feb 2025 00:00Current

7.3High risk

Vulners AI Score7.3

CVSS 3.18.1

EPSS0.0307

SSVC