EUVD-2025-200738
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Lifecycle Timeline
4Description
A flaw was found in WebKitGTK. This vulnerability allows remote, user-assisted information disclosure that can reveal any file the user is permitted to read via abusing the file drag-and-drop mechanism where WebKitGTK does not verify that drag operations originate from outside the browser.
Analysis
A flaw was found in WebKitGTK. This vulnerability allows remote, user-assisted information disclosure that can reveal any file the user is permitted to read via abusing the file drag-and-drop mechanism where WebKitGTK does not verify that drag operations originate from outside the browser.
Technical Context
Information disclosure occurs when an application inadvertently reveals sensitive data to unauthorized actors through error messages, logs, or improper access controls. This vulnerability is classified as Origin Validation Error (CWE-346).
Affected Products
Affected: WebKitGTK
Remediation
Implement proper access controls. Sanitize error messages in production. Review logging practices to avoid capturing sensitive data.
Priority Score
Vendor Status
Ubuntu
Priority: Medium| Release | Status | Version |
|---|---|---|
| jammy | DNE | - |
| noble | DNE | - |
| plucky | DNE | - |
| questing | DNE | - |
| upstream | needs-triage | - |
| bionic | ignored | - |
| xenial | ignored | - |
| Release | Status | Version |
|---|---|---|
| xenial | ignored | - |
| bionic | ignored | - |
| focal | ignored | - |
| upstream | released | 2.50.3 |
| jammy | released | 2.50.3-0ubuntu0.22.04.1 |
| noble | released | 2.50.3-0ubuntu0.24.04.1 |
| plucky | released | 2.50.3-0ubuntu0.25.04.1 |
| questing | released | 2.50.3-0ubuntu0.25.10.1 |
| Release | Status | Version |
|---|---|---|
| xenial | ignored | - |
| bionic | ignored | - |
| jammy | DNE | - |
| noble | DNE | - |
| plucky | DNE | - |
| questing | DNE | - |
| upstream | needs-triage | - |
| Release | Status | Version |
|---|---|---|
| xenial | ignored | - |
| bionic | ignored | - |
| focal | ignored | - |
| jammy | ignored | - |
| noble | ignored | - |
| plucky | DNE | - |
| questing | DNE | - |
| upstream | needs-triage | - |
| Release | Status | Version |
|---|---|---|
| focal | ignored | - |
| jammy | ignored | - |
| noble | DNE | - |
| plucky | DNE | - |
| questing | DNE | - |
| upstream | released | 2.50.3-1 |
Debian
| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| bullseye | fixed | 2.50.3-1~deb11u1 | - |
| bullseye (security) | fixed | 2.50.4-1~deb11u1 | - |
| bookworm, bookworm (security) | fixed | 2.50.4-1~deb12u1 | - |
| trixie (security), trixie | fixed | 2.50.4-1~deb13u1 | - |
| forky | fixed | 2.50.5-1 | - |
| sid | fixed | 2.50.6-1 | - |
| bookworm | fixed | 2.50.3-1~deb12u1 | - |
| trixie | fixed | 2.50.3-1~deb13u1 | - |
| (unstable) | fixed | 2.50.3-1 | - |
| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| bullseye (security), bullseye | vulnerable | 2.38.6-1~deb11u1 | - |
| bookworm | vulnerable | 2.38.6-1 | - |
| trixie | vulnerable | 2.48.3-1 | - |
| forky | fixed | 2.50.5-1 | - |
| sid | fixed | 2.50.6-1 | - |
| bullseye | fixed | (unfixed) | end-of-life |
| (unstable) | fixed | 2.50.3-1 | - |
Share
External POC / Exploit Code
Leaving vuln.today