CVE-2025-35430
CISA Thorium insecure downloaded file path validation
Summary
CISA Thorium insecure downloaded file path validation
Original description
The description as published by the source.
CISA Thorium does not adequately validate the paths of downloaded files via 'download_ephemeral' and 'download_children'. A remote, authenticated attacker could access arbitrary files subject to file system permissions. Fixed in 1.1.2.
References
- advisory github.com
- advisory nvd.nist.gov
- web github.com
- web github.com
- web raw.githubusercontent.com
- web cve.org