Cyber Posture

CVE-2025-24891

Critical

Published: 31 January 2025

Published
31 January 2025
Modified
15 April 2026
KEV Added
—
Patch
—
CVSS Score 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
EPSS Score 0.0013 31.3th percentile
Risk Priority 19 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may transfer tools or other files from an external system into a compromised environment.

Security Summary

CVE-2025-24891 is a path traversal vulnerability (CWE-22, CWE-276) affecting Dumb Drop, a file upload application. Published on 2025-01-31, it enables users with permission to upload files to the service to overwrite arbitrary system files through improper path handling. The vulnerability carries a CVSS v3.1 base score of 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), reflecting its critical severity due to network accessibility, low attack complexity, and potential for high impacts across confidentiality, integrity, and availability.

The attack scenario targets users able to interact with the upload functionality, which may include wholly unprivileged external attackers if the service runs without authentication enabled, or those possessing a PIN otherwise. Exploitation occurs over the network and requires user interaction, allowing attackers to leverage the default root privileges of the container to overwrite any system files without restriction. This can enable injection of malicious payloads into files executed on schedule or triggered by service actions, potentially granting full root access.

Mitigation details are provided in the Dumb Drop GitHub security advisory (GHSA-24f2-fv38-3274) and a related commit (cb586316648ccbfb21d27b84e90d72ccead9819d), which address the path traversal issue.

Details

CWE(s)
CWE-22CWE-276

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
T1105 Ingress Tool Transfer Command And Control
Adversaries may transfer tools or other files from an external system into a compromised environment.
attack.mitre.org →
Why these techniques?

Path traversal in public-facing file upload app allows arbitrary system file overwrites from network, directly enabling public app exploitation (T1190), root privilege escalation in container (T1068), and ingress of malicious payloads to arbitrary locations for later execution (T1105).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References