Code Execution Vulnerability in SecureDrop Client by Freedom of the Press Foundation

CVE-2025-24888

What is CVE-2025-24888?

The SecureDrop Client, which is used to facilitate secure communications between journalists and their sources, contains a vulnerability that could allow a compromised SecureDrop Server to execute arbitrary code on the client machine. Specifically, the flaw originates in the process of handling HTTP headers during the download of replies. When the client retrieves filenames from the Content-Disposition HTTP header, improperly sanitized filename inputs could be exploited, leading to files being saved in unchecked directories. This could enable an attacker to create an autostart file in the user's home configuration directory, allowing code execution when the client is restarted. No exploitation attempts have been recorded at this time, but users are advised to update to version 0.14.1 or above to mitigate any risks.

References