Improper Link Resolution Vulnerability in Qt Framework by The Qt Company

CVE-2025-4211

What is CVE-2025-4211?

This vulnerability in the Qt Framework's QFileSystemEngine on Windows allows attackers to exploit improper link resolution before file access. By abusing the GetTempPath API, an attacker can manipulate temporary file paths to potentially perform symlink attacks or access malicious files. This flaw is significant as it enables unauthorized access and could lead to privilege escalation, affecting public APIs such as QDir::tempPath() and related components like QTemporaryDir and QTemporaryFile. It's crucial for users of the affected versions to update to the latest releases to mitigate these risks, which have been addressed in subsequent updates.

References