Path Traversal Vulnerability in SecureDrop Client by Freedom of the Press Foundation

CVE-2025-24889

What is CVE-2025-24889?

The SecureDrop Client, utilized by journalists for secure communication, contains a vulnerability in its log file handling mechanism. Specifically, prior to versions 0.14.1 and 1.0.1, an attacker who has already gained access to a virtual machine within the SecureDrop Workstation can exploit this flaw to gain code execution in the isolated sd-log VM by submitting a malicious log entry. This exploitation is facilitated through unsanitized input from the logging VM, allowing an attacker to craft arbitrary VM names that can overwrite logs or write malicious content in critical directories. Though the vulnerability requires prior code execution on another VM, it poses a significant risk of lateral movement within the SecureDrop environment. The recent patches address these issues by sanitizing the VM name input to enhance overall security.

References