Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2025-35430

CISA Thorium insecure downloaded file path validation

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
cisa-cg

Description

CISA Thorium does not adequately validate the paths of downloaded files via 'download_ephemeral' and 'download_children'. A remote, authenticated attacker could access arbitrary files subject to file system permissions. Fixed in 1.1.2.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

CISA Thorium

Default version status: unknown

  • 1.0.0 to < 1.1.2affected
  • 1.1.2unaffected

References