PT-2025-44737 · Yandex · Yandex Disk

Published 2025-07-22 · Updated 2025-12-14 · CVE-2025-5470

Positive Technologies (AI Summary)

CVSS v4.0

7.3

High

Base vector

AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:X/RE:X/U:Amber

Name of the Vulnerable Software and Affected Versions Yandex Disk versions prior to 3.2.45.3275

Description A Search Order Hijacking issue exists in Yandex Disk on MacOS due to an uncontrolled search path element. This allows for exploitation of the system.

Recommendations Update Yandex Disk to version 3.2.45.3275 or later.

Fix

Untrusted Search Path

Uncontrolled Search Path Element

Weakness Enumeration

CWE-426

CWE-427

Related Identifiers

BDU:2025-08831

CVE-2025-5470

Affected Products

Yandex Disk

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-5470 · Security Note
• https://bdu.fstec.ru/vul/2025-08831 · Security Note
• https://yandex.com/bugbounty/i/hall-of-fame-products · Note
• https://reddit.com/r/pwnhub/comments/1omrv84/ey_data_leak_bind_9_vulnerability_chrome_flaw_and · Reddit Post
• https://twitter.com/CVEnew/status/2000248706164289899 · Twitter Post