EUVD-2025-18165
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
4Description
Path traversal in Google Web Designer's template handling versions prior to 16.3.0.0407 on Windows allows attacker to achieve remote code execution by tricking users into downloading a malicious ad template
Analysis
Path traversal vulnerability in Google Web Designer's template handling mechanism that enables remote code execution when users are socially engineered into downloading malicious ad templates. Versions prior to 16.3.0.0407 on Windows are affected, and the vulnerability requires user interaction (UI:R) but has no authentication requirements (PR:N). While CVSS 8.8 indicates high severity with complete confidentiality, integrity, and availability impact, exploitation probability and KEV status information is not provided in the available intelligence.
Technical Context
The vulnerability exists in Google Web Designer's ad template handling functionality on Windows platforms, where insufficient input validation (CWE-20: Improper Input Validation) allows attackers to exploit path traversal mechanisms. The vulnerability likely permits directory traversal sequences (e.g., ../ or absolute paths) in template file paths, enabling an attacker to write or execute arbitrary code outside the intended template directory. Google Web Designer is a WYSIWYG editor for creating HTML5-based ads; the template system is designed to import pre-built designs, but inadequate sanitization of file paths within these templates creates a privilege escalation path from template import to code execution. The Windows-specific nature suggests OS-level path resolution differences (backslash handling, UNC paths, or alternate data streams) may be exploited.
Affected Products
Google Web Designer versions prior to 16.3.0.0407 on Windows operating systems. CPE notation would be approximately: cpe:2.3:a:google:web_designer:*:*:*:*:*:windows:*:* (versions < 16.3.0.0407). The vulnerability is Windows-specific; macOS and Linux versions of Google Web Designer are not explicitly mentioned as affected. Organizations running version 16.3.0.0407 or later are not impacted.
Remediation
Immediate patching is required: (1) Update Google Web Designer to version 16.3.0.0407 or later on all affected Windows systems; (2) If immediate patching is not feasible, implement network-level controls restricting user downloads of ad templates from untrusted sources or disable template import functionality via group policy on Windows; (3) educate users against downloading ad templates from unverified or suspicious sources, particularly from email or unencrypted communication channels; (4) consider running Google Web Designer in isolated virtual environments or containers to limit code execution impact; (5) monitor for suspicious template imports or unusual file system activity in Web Designer working directories. Vendor advisory and patch download links should be obtained directly from Google's official security advisory or Web Designer release notes.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today