CVE-2025-24364 vaultwarden allows RCE in the admin panel

What is CVE-2025-24364?

CVE-2025-24364 is a high-severity command injection vulnerability in dani-garcia vaultwarden, published on 27 Jan 2025. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Attacker with authenticated access to the vaultwarden admin panel can execute arbitrary code in the system. The attacker could then change some settings to use sendmail as mail agent but adjust the settings in such a way that it would use a shell command. It then also needed to craft a special favicon image which would have the commands embedded to run during for example sending a test email. This vulnerability is fixed in 1.33.0.

Weakness: CWE-74

Which versions are affected by CVE-2025-24364?

It affects 1 product.

Products include Dani-Garcia Vaultwarden.

How do I fix CVE-2025-24364?

No fix has been published for CVE-2025-24364 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2025-24364 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-24364 exists.

Other vulnerabilities in dani-garcia vaultwarden

• CVE-2024-55225 Vaultwarden vulnerable to user impersonation Critical 9.8
• CVE-2024-55224 Vaultwarden HTML injection vulnerability Critical 9.6
• CVE-2024-39924 Privilege escalation in n/a High 8.8
• CVE-2026-43912 Vaultwarden: Cross-Org Group Binding Enables Unauthorized Read And Write Access Into Another Organization High 8.7
• CVE-2026-27802 Vaultwarden: Privilege Escalation via Bulk Permission Update to Unauthorized Collections by Manager High 8.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-h6cc-rc6q-23j4.