Safing Portmaster EUVD-2026-102955

Requires the attacker to already be able to execute an unprivileged local process on a host running Safing Portmaster before 2.2.5, and the local API (default on the machine) must be reachable so the process can issue a POST to /api/v1/updates/from-url - the endpoint performs no authorization (api.PermitAnyone), so no credentials or user interaction are needed once local code execution exists. Exploitation is LIMITED by three factors: it cannot be performed remotely (local access is a hard prerequisite), the installed payload must be a legitimately Safing-signed release so only genuine older versions can be forced (not arbitrary attacker binaries), and the value to an attacker is indirect - reintroducing a previously patched vulnerability rather than immediate compromise. Fixed in 2.2.5 by removing the endpoint entirely.

This is a genuine but modest-severity local vulnerability, not a top-tier priority. The input CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N) and the description agree and are internally consistent: exploitation requires an already-present unprivileged local process, so this is a local privilege/integrity issue rather than a remotely reachable flaw - AV:L and the 'local processes' wording do not conflict. Impact is limited to VI:L/VA:L with VC:N, reflecting that an attacker cannot read data or run arbitrary code directly; they can only force a downgrade to an older but still Safing-signed release, thereby reintroducing previously patched vulnerabilities (a staging primitive rather than direct compromise). No EPSS score, no CISA KEV listing, and no public exploit code are present in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The CWE-306 missing-authorization root cause is confirmed by the patch diff, which simply removes the api.PermitAnyone-registered updates/from-url endpoint and its UpdateFromURL handler. Net: a real, patch-confirmed weakness worth remediating, but the local-access prerequisite, lack of confidentiality impact, and signed-binary constraint keep real-world risk low-to-moderate.

An attacker who already has the ability to run an ordinary unprivileged process on a machine running Portmaster (e.g. via malware, a compromised user account, or a hostile local app) sends a POST request to the local http://api endpoint /api/v1/updates/from-url supplying an attacker-controlled index URL. Because the endpoint is registered with api.PermitAnyone, no authorization check occurs, and the supplied URL bypasses version checks and auto-apply settings, forcing installation of an older Safing-signed release. No public exploit code is identified at time of analysis, but the source-level commit diff makes the vulnerable endpoint and trigger trivially reproducible.