Web Designer CVE-2025-4613

Risk assessment indicates HIGH real-world priority despite requiring user interaction: (1) CVSS 8.8 with network vector (AV:N) and low complexity (AC:L) demonstrates this is trivially exploitable once a user downloads a malicious template; (2) the attack requires social engineering rather than technical exploitation complexity, making it practical against targeted users; (3) impact is complete across all security dimensions (C:H/I:H/A:H), enabling full system compromise; (4) user interaction requirement (UI:R) is the primary limiting factor—typical for file-based exploits, but feasible in targeted campaigns against ad designers and marketing teams; (5) absence of reported POC, EPSS score, or KEV designation suggests either recent disclosure or limited public exploitation, but does not reduce risk for organizations using affected versions. This should be treated as critical for any organization deploying Google Web Designer in production ad workflows.

An attacker crafts a malicious ad template file (.wdtemplate or equivalent format) containing path traversal sequences in file metadata or embedded resource references (e.g., '../../windows/system32/malicious.exe' or UNC paths pointing to attacker infrastructure). The attacker distributes this template via email, file-sharing platforms, or compromised ad template repositories, claiming it is a legitimate design template (e.g., 'Q4_Marketing_Template_2025.wdtemplate'). When an unsuspecting ad designer or marketing professional opens this template in Google Web Designer versions < 16.3.0.0407, the path traversal vulnerability is triggered during template extraction or resource loading. The attacker's payload is written to an arbitrary location (e.g., Windows Startup folder, AppData directory, or browser extension folder) or executed directly, achieving code execution in the context of the user running Web Designer. If the user has administrative privileges or if the code is written to a path that auto-executes on reboot, full system compromise is achieved. No POC has been publicly disclosed according to available intelligence, but exploitation requires only social engineering and a malicious template file, making it practical for targeted attacks against marketing and creative teams.