CVE-2025-59345 - CVE House

Back to Database

Status published High CVE-2025-59345

Dragonfly did not enable authentication for some Manager’s endpoints

7.7 CVSS

Vulnerability Description

Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, The /api/v1/jobs and /preheats endpoints in Manager web UI are accessible without authentication. Any user with network access to the Manager can create, delete, and modify jobs, and create preheat jobs. An unauthenticated adversary with network access to a Manager web UI uses /api/v1/jobs endpoint to create hundreds of useless jobs. The Manager is in a denial-of-service state, and stops accepting requests from valid administrators. This vulnerability is fixed in 2.1.0.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-59345

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from dragonflyoss

View All →

Dragonfly tiny file download uses hard coded HTTP protocol

Dragonfly has weak integrity checks for downloaded files

Manager generates mTLS certificates for arbitrary IP addresses

Dragonfly allows arbitrary file read and write on a peer machine

Dragonfly possibly panics due to nil pointer dereference when using variables created alongside an error

Affected Vendor

dragonflyoss

View all reports →

Affected Software

dragonfly

Vulnerable Versions:

< 2.1.0

Timeline

Official Publish: September 17th, 2025

Last Modified: October 13th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1078 Valid Accounts

T1136 Create Account

T1098 Account Manipulation

Privilege Escalation

T1021 Remote Services

Lateral Movement