CVE-2025-13947 - CVE House
Back to Database
Status published High CVE-2025-13947

Webkit: webkitgtk: remote user-assisted information disclosure via file drag-and-drop

Vulnerability Description

A flaw was found in WebKitGTK. This vulnerability allows remote, user-assisted information disclosure that can reveal any file the user is permitted to read via abusing the file drag-and-drop mechanism where WebKitGTK does not verify that drag operations originate from outside the browser.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-13947

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Red Hat would like to thank Janet Black for reporting this issue.

References

More from The WebKitGTK Team

View All →
CVE-2025-66287
Webkitgtk: processing maliciously crafted web content may lead to an unexpected process crash
High 8.8
CVE-2025-13502
Webkit: webkitgtk / wpe webkit: out-of-bounds read and integer underflow vulnerability leading to dos
High 7.5

Affected Vendor

The WebKitGTK Team

View all reports →

Affected Software

webkitgtk, Red Hat Enterprise Linux 7 Extended Lifecycle Support, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.2 Advanced Update Support, Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On, Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.6 Telecommunications Update Service, Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.8 Telecommunications Update Service, Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.4 Extended Update Support, Red Hat Enterprise Linux 9.6 Extended Update Support, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7
Vulnerable Versions:
0, 0:2.50.3-2.el7_9, 0:2.50.3-1.el8_10, 0:2.50.3-2.el8_2, 0:2.50.3-2.el8_4, 0:2.50.3-2.el8_6, 0:2.50.3-2.el8_8, 0:2.50.3-1.el9_7, 0:2.50.3-1.el9_0, 0:2.50.3-1.el9_2, 0:2.50.3-1.el9_4, 0:2.50.3-1.el9_6

Timeline

Official Publish: December 3rd, 2025
Last Modified: June 29th, 2026
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.