by Kastro
Paper/Archive/CVE-2025-59352

CVE-2025-59352

dragonflyoss dragonfly — Dragonfly allows arbitrary file read and write on a peer machine

EPSS 0.7%CVSS 9.8
critical.is priorityof 100
40
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 54.2.542 × 2010.8No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, the gRPC API and HTTP APIs allow peers to send requests that force the recipient peer to create files in arbitrary file system locations, and to read arbitrary files. This allows peers to steal other peers’ secret data and to gain remote code execution (RCE) capabilities on the peer’s machine.This vulnerability is fixed in 2.1.0.

Affected

ProductAffectedFixed inSource
dragonfly< 2.1.0–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GitHub_M (CNA)6.9CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:P
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

refgithub.com/dragonflyoss/dragonfly/security/advisories/GHSA-79hx-3fp8-hj66refgithub.com/dragonflyoss/dragonfly/blob/main/docs/security/dragonfly-comprehensive-report-2023.pdf