EUVD-2025-18165Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
7DescriptionCVE.org
Path traversal in Google Web Designer's template handling versions prior to 16.3.0.0407 on Windows allows attacker to achieve remote code execution by tricking users into downloading a malicious ad template
AnalysisAI
Path traversal vulnerability in Google Web Designer's template handling mechanism that enables remote code execution when users are socially engineered into downloading malicious ad templates. Versions prior to 16.3.0.0407 on Windows are affected, and the vulnerability requires user interaction (UI:R) but has no authentication requirements (PR:N). While CVSS 8.8 indicates high severity with complete confidentiality, integrity, and availability impact, exploitation probability and KEV status information is not provided in the available intelligence.
Technical ContextAI
The vulnerability exists in Google Web Designer's ad template handling functionality on Windows platforms, where insufficient input validation (CWE-20: Improper Input Validation) allows attackers to exploit path traversal mechanisms. The vulnerability likely permits directory traversal sequences (e.g., ../ or absolute paths) in template file paths, enabling an attacker to write or execute arbitrary code outside the intended template directory. Google Web Designer is a WYSIWYG editor for creating HTML5-based ads; the template system is designed to import pre-built designs, but inadequate sanitization of file paths within these templates creates a privilege escalation path from template import to code execution. The Windows-specific nature suggests OS-level path resolution differences (backslash handling, UNC paths, or alternate data streams) may be exploited.
RemediationAI
Immediate patching is required: (1) Update Google Web Designer to version 16.3.0.0407 or later on all affected Windows systems; (2) If immediate patching is not feasible, implement network-level controls restricting user downloads of ad templates from untrusted sources or disable template import functionality via group policy on Windows; (3) educate users against downloading ad templates from unverified or suspicious sources, particularly from email or unencrypted communication channels; (4) consider running Google Web Designer in isolated virtual environments or containers to limit code execution impact; (5) monitor for suspicious template imports or unusual file system activity in Web Designer working directories. Vendor advisory and patch download links should be obtained directly from Google's official security advisory or Web Designer release notes.
Windows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
Windows Win32k contains an out-of-bounds write vulnerability enabling local privilege escalation to SYSTEM, exploited by
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred
Same weakness CWE-20 – Improper Input Validation
View allShare
External POC / Exploit Code
Leaving vuln.today