Cyber Posture

CVE-2025-27142

High

Published: 25 February 2025

Published
25 February 2025
Modified
28 February 2025
KEV Added
—
Patch
—
CVSS Score 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0465 89.3th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may establish persistence through executing malicious commands triggered by a user’s shell.

Security Summary

CVE-2025-27142 is a path traversal vulnerability (CWE-22) in LocalSend, a free open-source cross-platform app for sharing files and messages over local networks without internet. Affecting versions prior to 1.17.0, the flaw stems from inadequate path sanitization in the POST /api/localsend/v2/prepare-upload and POST /api/localsend/v2/upload endpoints, enabling attackers to write files to arbitrary system locations. This can facilitate remote command execution, such as by placing malicious files in Windows startup folders or Linux Bash-related directories. The issue carries a CVSS v3.1 base score of 8.8 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Attackers on the adjacent network (AV:A) can exploit this without authentication (PR:N) by sending a crafted file transfer request from a nearby device. If the victim has Quick Save enabled, files are written silently without user interaction (UI:N), allowing arbitrary file placement that leads to command execution upon system events like reboots or logins. No elevated privileges are required, making it accessible to unauthenticated nearby adversaries.

The LocalSend security advisory (GHSA-f7jp-p6j4-3522) and fixing commit (e8635204ec782ded45bc7d698deb60f3c4105687) confirm that upgrading to version 1.17.0 resolves the vulnerability through proper path sanitization in the affected endpoints. Security practitioners should advise users to update immediately and disable Quick Save until patched.

Details

CWE(s)
CWE-22

Affected Products

localsend
localsend
≤ 1.17.0

MITRE ATT&CK Enterprise Techniques

T1210 Exploitation of Remote Services Lateral Movement
Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.
attack.mitre.org →
T1547.001 Registry Run Keys / Startup Folder Persistence
Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key.
attack.mitre.org →
T1546.004 Unix Shell Configuration Modification Privilege Escalation
Adversaries may establish persistence through executing malicious commands triggered by a user’s shell.
attack.mitre.org →
Why these techniques?

Path traversal in upload endpoints allows arbitrary file writes via the exposed local network API, directly enabling exploitation of the remote service (T1210) to place malicious payloads in Windows startup folders (T1547.001) or Linux Bash configuration directories (T1546.004) for RCE.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References