PT-2025-22906 · Google · Web Designer App+1

Bálint Magyar · Published 2025-05-26 · Updated 2025-08-01 · CVE-2025-4613

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Google Web Designer versions prior to 16.3.0.0407

Description The issue allows an attacker to achieve remote code execution by tricking users into downloading a malicious ad template. This is due to path traversal in Google Web Designer's template handling on Windows.

Recommendations For versions prior to 16.3.0.0407, update to version 16.3.0.0407 or later to resolve the issue. As a temporary workaround, consider avoiding the download of ad templates from untrusted sources until the update is applied. Restrict access to template handling features in Google Web Designer to minimize the risk of exploitation.

Exploit

Fix

RCE

Path traversal

Weakness Enumeration

CWE-22

CWE-20

Related Identifiers

CVE-2025-4613

Affected Products

Web Designer App

Web Designer

References · 12

• 🔥 https://balintmagyar.com/articles/google-web-designer-path-traversal-client-side-rce-cve-2025-4613 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-4613 · Security Note
• https://osv.dev/vulnerability/CVE-2025-4613 · Vendor Advisory
• https://t.me/cvenotify/125461 · Telegram Post
• https://t.me/latest_high_impact_cve/2618 · Telegram Post
• https://twitter.com/CVEnew/status/1933096244546834540 · Twitter Post
• https://t.me/latest_high_impact_cve/2620 · Telegram Post
• https://twitter.com/SecAideInfo/status/1933830271486300255 · Twitter Post
• https://twitter.com/gvrp_writeups/status/1926848515394703669 · Twitter Post
• https://t.me/latest_high_impact_cve/2619 · Telegram Post
• https://t.me/cvetracker/26075 · Telegram Post
• https://t.me/cveNotify/130629 · Telegram Post