CVE-2025-59334 (CNNVD-202509-2325)
中文标题:
Linkr 安全漏洞
英文标题:
Linkr allows manifest tampering leading to arbitrary file injection
漏洞描述
中文描述:
Linkr是Mohammad Zain个人开发者的一个文件传输系统。 Linkr 2.0.0及之前版本存在安全漏洞，该漏洞源于未验证.linkr清单文件的完整性和真实性，可能导致任意文件注入和远程代码执行。
英文描述:
Linkr is a lightweight file delivery system that downloads files from a webserver. Linkr versions through 2.0.0 do not verify the integrity or authenticity of .linkr manifest files before using their contents, allowing a tampered manifest to inject arbitrary file entries into a package distribution. An attacker can modify a generated .linkr manifest (for example by adding a new entry with a malicious URL) and when a user runs the extract command the client downloads the attacker-supplied file without verification. This enables arbitrary file injection and creates a potential path to remote code execution if a downloaded malicious binary or script is later executed. Version 2.0.1 adds a manifest integrity check that compares the checksum of the original author-created manifest to the one being extracted and aborts on mismatch, warning if no original manifest is hosted. Users should update to 2.0.1 or later. As a workaround prior to updating, use only trusted .linkr manifests, manually verify manifest integrity, and host manifests on trusted servers.
CWE类型:
标签:
受影响产品
| 厂商 | 产品 | 版本 | 版本范围 | 平台 | CPE |
|---|---|---|---|---|---|
| mohammadzain2008 | Linkr | < 2.0.1 | - | - |
cpe:2.3:a:mohammadzain2008:linkr:<_2.0.1:*:*:*:*:*:*:*
|
| mohammadzain2008 | linkr | * | - | - |
cpe:2.3:a:mohammadzain2008:linkr:*:*:*:*:*:*:*:*
|
解决方案
中文解决方案:
英文解决方案:
临时解决方案:
CVSS评分详情
3.1 (cna)
CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
时间信息
利用信息
数据源详情
| 数据源 | 记录ID | 版本 | 提取时间 |
|---|---|---|---|
| CVE | cve_CVE-2025-59334 |
2025-11-11 15:23:31 | 2025-11-11 07:40:46 |
| NVD | nvd_CVE-2025-59334 |
2025-11-11 15:01:03 | 2025-11-11 07:48:33 |
| CNNVD | cnnvd_CNNVD-202509-2325 |
2025-11-11 15:12:57 | 2025-11-11 08:00:11 |
版本与语言
安全公告
变更历史
查看详细变更
- vulnerability_type: 未提取 -> 其他
- cnnvd_id: 未提取 -> CNNVD-202509-2325
- data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
查看详细变更
- affected_products_count: 1 -> 2
- data_sources: ['cve'] -> ['cve', 'nvd']