PT-2025-38271 · Dragonfly · Dragonfly

Gaius-Qi · Published 2025-09-17 · Updated 2025-10-27 · CVE-2025-59352

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dragonfly versions prior to 2.1.0

Description Dragonfly’s gRPC API and HTTP APIs allow peers to send requests that force the recipient peer to create files in arbitrary file system locations and to read arbitrary files. This can allow peers to steal secret data and gain remote code execution (RCE) capabilities on the peer’s machine. The vulnerability is related to file handling within the os.OpenFile() and io.Copy() functions. The code snippet shows how the DataFilePath is used to open a file and how io.Copy() is used to copy data into the file, potentially allowing arbitrary file creation and modification.

Recommendations Upgrade to version 2.1.0 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

CWE-202

Related Identifiers

CVE-2025-59352

GHSA-79HX-3FP8-HJ66

GO-2025-3971

OPENSUSE-SU-2025:15576-1

SUSE-SU-2025:3799-1

Affected Products

Dragonfly

References · 47

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59352.json · Exploit
• https://github.com/dragonflyoss/dragonfly/security/advisories/GHSA-79hx-3fp8-hj66 · Patch
• https://osv.dev/vulnerability/CVE-2025-59352 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:3799-1 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-3971 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-79hx-3fp8-hj66 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-59352 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2025:15576-1 · Vendor Advisory
• https://github.com/dragonflyoss/dragonfly · Note
• https://github.com/dragonflyoss/dragonfly/blob/main/docs/security/dragonfly-comprehensive-report-2023.pdf · Note
• https://suse.com/security/cve/CVE-2025-59346 · Note
• https://suse.com/security/cve/CVE-2024-58267 · Note
• https://suse.com/security/cve/CVE-2025-59348 · Note
• https://suse.com/security/cve/CVE-2025-47910 · Note
• https://suse.com/security/cve/CVE-2025-23267 · Note