CVE-2025-24891 Dumb Drop has an arbitrary file overwrite and path traversal for root shell
Attackers can exploit path traversal to overwrite system files and gain root access, especially if authentication is disabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-24891?
CVE-2025-24891 is a critical path traversal vulnerability in DumbWareio DumbDrop, published on 31 Jan 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Dumb Drop is a file upload application. Users with permission to upload to the service are able to exploit a path traversal vulnerability to overwrite arbitrary system files. As the container runs as root by default, there is no limit to what can be overwritten. With this, it's possible to inject malicious payloads into files ran on schedule or upon certain service actions. As the service is not required to run with authentication enabled, this may permit wholly unprivileged users root access. Otherwise, anybody with a PIN.
Which versions are affected by CVE-2025-24891?
How do I fix CVE-2025-24891?
No fix has been published for CVE-2025-24891 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2025-24891 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-24891 exists.
Sources
Also known as GHSA-24f2-fv38-3274.