CVE-2025-59352 - CVE House
Back to Database
Status published Medium CVE-2025-59352

Dragonfly allows arbitrary file read and write on a peer machine

Vulnerability Description

Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, the gRPC API and HTTP APIs allow peers to send requests that force the recipient peer to create files in arbitrary file system locations, and to read arbitrary files. This allows peers to steal other peers’ secret data and to gain remote code execution (RCE) capabilities on the peer’s machine.This vulnerability is fixed in 2.1.0.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-59352

Credits & Attribution

No credits recorded in the NVD database.

References

More from dragonflyoss

View All →
CVE-2025-59410
Dragonfly tiny file download uses hard coded HTTP protocol
Medium 5.5
CVE-2025-59354
Dragonfly has weak integrity checks for downloaded files
Medium 5.5
CVE-2025-59353
Manager generates mTLS certificates for arbitrary IP addresses
High 7.7
CVE-2025-59351
Dragonfly possibly panics due to nil pointer dereference when using variables created alongside an error
Low 2.7
CVE-2025-59350
Timing attacks against Proxy’s basic authentication are possible
Low 2.7

Affected Vendor

dragonflyoss

View all reports →

Affected Software

dragonfly
Vulnerable Versions:
< 2.1.0

Timeline

Official Publish: September 17th, 2025
Last Modified: September 18th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-202 CWE-22

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1005 Data from Local System
Collection
T1552 Unsecured Credentials
Credential Access
T1565.001 Stored Data Manipulation
Impact