What is CVE-2025-32018?

CVE-2025-32018 is a high-severity vulnerability in Getcursor Cursor, classified under Path Traversal. CVSS score: 8.0/10. Published 2025-04-08.

How severe is CVE-2025-32018?

High severity. CVSS v3 base score is 8.0 out of 10.

Path Traversal in Getcursor Cursor

CVE-2025-32018

Cursor is a code editor built for programming with AI. In versions 0.45.0 through 0.48.6, the Cursor app introduced a regression affecting the set of file paths the Cursor Agent is permitted to modify automatically. Under specific conditions, the agent could be prompted, either directly by the user or via maliciously crafted context, to automatically write to files outside of the opened workspace. This behavior required deliberate prompting, making successful exploitation highly impractical in real-world scenarios. Furthermore, the edited file was still displayed in the UI as usual for user review, making it unlikely for the edit to go unnoticed by the user. This vulnerability is fixed in 0.48.7.

Vulnerability class: Path Traversal (Directory Traversal)

EPSS: 0.004 (30.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.0 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H.

Affected products

Getcursor Cursor — versions >= 0.45.0, < 0.48.7

Weakness classification (CWE)

CWE-22 — Path Traversal

References

security-advisories@github.com (x_refsource_CONFIRM)

Frequently asked questions

What is CVE-2025-32018?: CVE-2025-32018 is a high-severity vulnerability in Getcursor Cursor, classified under Path Traversal. CVSS score: 8.0/10. Published 2025-04-08.
How severe is CVE-2025-32018?: High severity. CVSS v3 base score is 8.0 out of 10.