Vulnerability in Localsend
CVE-2025-54792
LocalSend is an open-source app to securely share files and messages with nearby devices over local networks without needing an internet connection. In versions 1.16.1 and below, a critical Man-in-the-Middle (MitM) vulnerability in the software's discovery protocol allows an unauthenticated attacker on the same local network to impersonate legitimate devices, silently intercepting, reading, and modifying any file transfer. This can be used to steal sensitive data or inject malware, like ransomware, into files shared between trusted users. The attack is hardly detectable and easy to implement, posing a severe and immediate security risk. This issue was fixed in version 1.17.0.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.8 (Medium). Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N.
EPSS exploit prediction
EPSS: 0.003 (15.7th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 16th percentile — 15.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: 0.000
Affected products
- Localsend — versions <= 1.17.0
Weakness classification (CWE)
References
- github.com/localsend/localsend/security/advisories/GHSA-424h-5f6m-x63f (Exploit, Vendor Advisory)
- github.com/localsend/localsend/commit/e8635204ec782ded45bc7d698deb60f3c4105687 (Patch)
- github.com/localsend/localsend/releases/tag/v1.17.0 (Release Notes)
Frequently asked questions
- What is CVE-2025-54792?
- CVE-2025-54792 is a medium-severity vulnerability in Localsend, classified under Channel Accessible by Non-Endpoint. CVSS score: 6.8/10. Published 2025-08-01.
- How severe is CVE-2025-54792?
- Medium severity. CVSS v3 base score is 6.8 out of 10.