What is the CVSS score of EUVD-2025-19714?

EUVD-2025-19714 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N. EPSS exploitation probability: 0.1%.

Which versions of Linkwarden are affected by EUVD-2025-19714?

Organizations using Linkwarden face significant risk from CVE-2025-49588 rated CVSS 8.7.

How to fix or mitigate EUVD-2025-19714?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Monitor vendor channels for patch availability.

Linkwarden EUVD-2025-19714

| CVE-2025-49588 HIGH

External Control of File Name or Path (CWE-73)

2025-07-02 security-advisories@github.com

Information Disclosure

8.7

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Lifecycle Timeline

EUVD ID Assigned

Mar 16, 2026 - 01:55 euvd

EUVD-2025-19714

Analysis Generated

Mar 16, 2026 - 01:55 vuln.today

CVE Published

Jul 02, 2025 - 14:15 nvd

HIGH 8.7

DescriptionGitHub Advisory

Linkwarden is a self-hosted, open-source collaborative bookmark manager to collect, organize and archive webpages. In version 2.10.2, the server accepts links of format file:///etc/passwd and doesn't do any validation before sending them to parsers and playwright, this can result in leak of other user's links (and in some cases it might be possible to leak environment secrets). This issue has been patched in version 2.10.3 which has not been made public at time of publication.