PT-2025-22525 · Unknown · Wire-Webapp

Sanojwr · Published 2025-05-22 · Updated 2025-05-30 · CVE-2025-48066

Positive Technologies (AI Summary)

CVSS v3.1

6.0

Medium

Base vector

AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions wire-webapp versions prior to 2025-05-14-production.0

Description A regression issue in the function to delete local data causes the client's local database not to be deleted upon user logout, even when instructed to do so. This affects both temporary clients and regular clients attempting to delete personal information and conversations. Access to the machine is required to access the data, and if encryption-at-rest is used, cryptographic material cannot be exported.

Recommendations For versions prior to 2025-05-14-production.0, manually delete the database on devices where the option "This is a public computer" was used prior to login or a logout with the request to delete local data has happened before. Update to wire-webapp version 2025-05-14-production.0 to resolve the issue.

Exploit

Fix

Weakness Enumeration

CWE-212

CWE-226

Related Identifiers

CVE-2025-48066

GHSA-QC6C-2HH8-QFH8

Affected Products

Wire-Webapp

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48066.json · Exploit
• https://github.com/wireapp/wire-webapp/security/advisories/GHSA-qc6c-2hh8-qfh8 · Vendor Advisory
• https://github.com/wireapp/wire-webapp/commit/4c0ed5f1e9e0fcfceedf3c29034defce6e1fea77 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-48066 · Security Note
• https://osv.dev/vulnerability/CVE-2025-48066 · Vendor Advisory
• https://twitter.com/dailycve/status/1928279133756281042 · Twitter Post
• https://twitter.com/CVEnew/status/1925610249018392729 · Twitter Post