CVE-2025-59352 Dragonfly allows arbitrary file read and write on a peer machine

What is CVE-2025-59352?

CVE-2025-59352 is a medium-severity path traversal vulnerability in dragonflyoss dragonfly, published on 17 Sep 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, the gRPC API and HTTP APIs allow peers to send requests that force the recipient peer to create files in arbitrary file system locations, and to read arbitrary files. This allows peers to steal other peers’ secret data and to gain remote code execution (RCE) capabilities on the peer’s machine.This vulnerability is fixed in 2.1.0.

Weakness: CWE-22, CWE-202

Which versions are affected by CVE-2025-59352?

6 open source packages ship an affected version, including github.com/dragonflyoss/dragonfly and d7y.io/dragonfly/v2. It affects 1 product.

Products include Linuxfoundation Dragonfly.

How do I fix CVE-2025-59352?

Upgrade github.com/dragonflyoss/dragonfly to 2.1.0 or later.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2025-59352 being exploited?

There is no known exploitation of CVE-2025-59352 in the wild and no public exploit code.

Other vulnerabilities in dragonflyoss dragonfly

• CVE-2023-27584 Dragonfly2 vulnerable to hard coded cyptographic key Critical 9.8
• CVE-2026-24124 Dragonfly Manager Job API Allows Unauthenticated Access High 8.9
• CVE-2025-59345 Dragonfly did not enable authentication for some Manager’s endpoints High 7.7
• CVE-2025-59353 Manager generates mTLS certificates for arbitrary IP addresses High 7.7
• CVE-2025-59346 Dragonfly server-side request forgery vulnerability Medium 5.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-79hx-3fp8-hj66, GO-2025-3971.