What is CVE-2025-24889?

CVE-2025-24889 is a medium-severity vulnerability in Freedomofpress Securedrop-client, classified under Path Traversal. CVSS score: 4.5/10. Published 2025-02-13.

How severe is CVE-2025-24889?

Medium severity. CVSS v3 base score is 4.5 out of 10.

Path Traversal in Freedomofpress Securedrop-client

CVE-2025-24889

The SecureDrop Client is a desktop application for journalists to communicate with sources and work with submissions on the SecureDrop Workstation. Prior to versions 0.14.1 and 1.0.1, an attacker who has already gained code execution in a…

Vulnerability class: Path Traversal (Directory Traversal)

EPSS: 0.001 (21.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.5 (Medium). Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N.

Affected products

Freedomofpress Securedrop-client — versions < 0.14.1, = 1.0.0

Weakness classification (CWE)

CWE-22 — Path Traversal

References

https://github.com/freedomofpress/securedrop-client/security/advisories/GHSA-933q-fx9h-5g46 (x_refsource_CONFIRM)
https://github.com/freedomofpress/securedrop-client/commit/3012bf7289389b5ec0f5f4db0f009a17dee1f586 (x_refsource_MISC)

Frequently asked questions

What is CVE-2025-24889?: CVE-2025-24889 is a medium-severity vulnerability in Freedomofpress Securedrop-client, classified under Path Traversal. CVSS score: 4.5/10. Published 2025-02-13.
How severe is CVE-2025-24889?: Medium severity. CVSS v3 base score is 4.5 out of 10.