PT-2025-7912 · Localsend · Localsend

Ry0Tak · Published 2025-02-25 · Updated 2025-02-26 · CVE-2025-27142

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions LocalSend versions prior to 1.17.0

Description The issue arises from the missing sanitization of the path in the "POST /api/localsend/v2/prepare-upload" and "POST /api/localsend/v2/upload" endpoints, allowing a malicious file transfer request to write files to arbitrary locations on the system. This can result in remote command execution, typically via the startup folder on Windows or Bash-related files on Linux. If the Quick Save feature is enabled, files can be written silently without explicit user interaction.

Recommendations For versions prior to 1.17.0, update to version 1.17.0 to resolve the issue. As a temporary workaround, consider disabling the Quick Save feature to prevent silent file writing. Restrict access to the "POST /api/localsend/v2/prepare-upload" and "POST /api/localsend/v2/upload" endpoints to minimize the risk of exploitation.

Exploit

Fix

RCE

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-27142

GHSA-F7JP-P6J4-3522

Affected Products

Localsend

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/27xxx/CVE-2025-27142.json · Exploit
• https://github.com/localsend/localsend/commit/e8635204ec782ded45bc7d698deb60f3c4105687 · Patch
• https://github.com/localsend/localsend/security/advisories/GHSA-f7jp-p6j4-3522 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-27142 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-27142 · Security Note
• https://t.me/cvedetector/18925 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1894584175962825112 · Twitter Post
• https://twitter.com/CVEnew/status/1894496058056872194 · Twitter Post