PT-2025-3996 · Cloudflare · Cloudflare Warp

Published 2025-01-22 · Updated 2025-07-31 · CVE-2025-0651

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cloudflare WARP versions prior to 2024.12.492.0

Description The issue is related to improper privilege management in Cloudflare WARP on Windows, allowing file manipulation. A user with low system privileges can create symlinks inside the C:ProgramDataCloudflarewarp-diag-partials folder. After triggering the 'Reset all settings' option, the WARP service, which operates with System privileges, will delete the files that the symlink was pointing to, potentially leading to the deletion of files owned by the System user.

Recommendations For versions prior to 2024.12.492.0, update to version 2024.12.492.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the C:ProgramDataCloudflarewarp-diag-partials folder to prevent the creation of symlinks. Additionally, avoid using the 'Reset all settings' option until the update is applied.

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2025-0651

Affected Products

Cloudflare Warp

References · 6

• https://osv.dev/vulnerability/CVE-2025-0651 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-0651 · Security Note
• https://twitter.com/CVEnew/status/1882137384122519962 · Twitter Post
• https://developers.cloudflare.com/warp-client · Note
• https://t.me/cveNotify/130456 · Telegram Post
• https://t.me/cvedetector/16136 · Telegram Post