CVE-2025-14602 Weak File Name Generation in vsDesk
Remote attackers can predict uploaded file names to access sensitive files, potentially facilitating further attacks.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-14602?
CVE-2025-14602 is a medium-severity vulnerability in vsDesk, published on 20 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The application generates uploaded file names using a weak and predictable method based on the request timestamp. This allows a remote attacker to accurately guess or brute-force the generated filename within a short time window. An attacker can successfully locate and access uploaded files, which can be used to facilitate further attacks.
Apply patch from vendor https://vsdesk.ru/ . Versions 14.0101 and on have the patch.
Which versions are affected by CVE-2025-14602?
How do I fix CVE-2025-14602?
No fix has been published for CVE-2025-14602 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-14602 being exploited?
There is no known exploitation of CVE-2025-14602 in the wild and no public exploit code.
Sources
Also known as GHSA-2vv3-69qg-3hgr.