PT-2025-26188 · Cryptpad · Cryptpad

Lachlan2K · Published 2025-06-18 · Updated 2025-08-11 · CVE-2025-49591

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions CryptPad versions prior to 2025.3.0

Description The issue concerns a weak implementation of access controls in CryptPad, allowing an attacker who compromises a user's credentials to gain access to the victim's account, even if the victim has Two-Factor Authentication (2FA) set up. This is due to 2FA not being enforced if the path parameter is not 44 characters long, which can be bypassed by URL encoding a single character in the path.

Recommendations For versions prior to 2025.3.0, update to version 2025.3.0 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive areas of the application to minimize the risk of exploitation. Avoid using URL encoded paths in the affected API endpoints until the issue is resolved.

Exploit

Fix

Improper Authentication

Improper Access Control

Weakness Enumeration

CWE-287

CWE-284

Related Identifiers

CVE-2025-49591

GHSA-XQ5X-WGCM-3P33

Affected Products

Cryptpad

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/49xxx/CVE-2025-49591.json · Exploit
• https://github.com/cryptpad/cryptpad/security/advisories/GHSA-xq5x-wgcm-3p33 · Vendor Advisory
• https://github.com/cryptpad/cryptpad/commit/f624f9d457d36040f57c7598d98a8b9461b79837 · Patch
• https://github.com/cryptpad/cryptpad/commit/0c5d4bbf5e5206d53470ea86a664fa2b703fb611 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-49591 · Security Note
• https://osv.dev/vulnerability/CVE-2025-49591 · Vendor Advisory
• https://github.com/cryptpad/cryptpad · Note
• https://github.com/cryptpad/cryptpad/blob/15c81aa8ccb737a9a1167481f4a699af331364bb/lib/http-worker.js#L356-L364 · Note
• https://twitter.com/VulmonFeeds/status/1935480898142499109 · Twitter Post
• https://t.me/cvenotify/126130 · Telegram Post
• https://t.me/cveNotify/131710 · Telegram Post
• https://t.me/latest_high_impact_cve/2713 · Telegram Post
• https://twitter.com/CVEnew/status/1935723280994082943 · Twitter Post
• https://t.me/cvetracker/26532 · Telegram Post