LocalSend File Transfer Vulnerability in Open-Source Application

CVE-2025-27142

Summary

LocalSend is a free, open-source application designed for secure file sharing over local networks without the need for an internet connection. However, prior to version 1.17.0, it exhibited a critical flaw in its handling of file transfer requests. Specifically, the application failed to properly sanitize file paths in its POST /api/localsend/v2/prepare-upload and POST /api/localsend/v2/upload endpoints. This oversight allowed attackers to send crafted file transfer requests that could manipulate file locations on the user’s system, resulting in arbitrary file writes and potential remote command execution. Particularly concerning is the use of the 'Quick Save' feature, which could execute these malicious actions without user consent or intervention. This vulnerability has been addressed in version 1.17.0, making immediate updates essential for users.

References