PT-2025-5612 · Dumpdrop · Dumpdrop

L8Bl · Published 2025-02-04 · Updated 2025-02-05 · CVE-2025-24971

Positive Technologies (AI Summary)

CVSS v4.0

9.5

Critical

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions DumpDrop (affected versions not specified)

Description The issue is related to an OS Command Injection vulnerability in the DumpDrop application, specifically in the "/upload/init" endpoint. This vulnerability could allow an attacker to execute arbitrary code remotely when the Apprise Notification is enabled. There are no known workarounds for this issue.

Recommendations As a temporary workaround, consider disabling the Apprise Notification feature until a patch is available. Restrict access to the "/upload/init" endpoint to minimize the risk of exploitation. Patch the vulnerability by applying the commit 4ff8469d.

Exploit

Fix

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2025-24971

GHSA-RX8M-JQM7-VCGP

Affected Products

Dumpdrop

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/24xxx/CVE-2025-24971.json · Exploit
• 🔥 https://github.com/DumbWareio/DumbDrop/security/advisories/GHSA-rx8m-jqm7-vcgp · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-24971 · Security Note
• https://osv.dev/vulnerability/CVE-2025-24971 · Vendor Advisory
• https://github.com/DumbWareio/DumbDrop/commit/4ff8469d69019d200046a67d326f51703bc4da63 · Note
• https://t.me/cvedetector/17236 · Telegram Post
• https://twitter.com/BursaMatus/status/1886882658812105065 · Twitter Post
• https://twitter.com/BursaMatus/status/1886912941485686860 · Twitter Post
• https://twitter.com/CVEnew/status/1886855075403841642 · Twitter Post
• https://twitter.com/CveFindCom/status/1886852600844132467 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1887035322120192041 · Twitter Post