CVE-2025-13947

High CVSS: 7.4

A flaw was found in WebKitGTK. This vulnerability allows remote, user-assisted information disclosure that can reveal any file the user is permitted to read via abusing the file drag-and-drop mechanism where WebKitGTK does not verify that drag operations originate from outside the browser.

Vendor

Product

CWE

CWE-346

Yayın Tarihi

2025-12-03 10:15:47

Güncelleme

2026-01-07 16:15:48

Source Identifier

secalert@redhat.com

KEV Date Added

Kategoriler

CWE-346 HIGH 2025

Referanslar

https://access.redhat.com/errata/RHSA-2025:22789 https://access.redhat.com/errata/RHSA-2025:22790 https://access.redhat.com/errata/RHSA-2025:23110 https://access.redhat.com/errata/RHSA-2025:23433 https://access.redhat.com/errata/RHSA-2025:23434 https://access.redhat.com/errata/RHSA-2025:23451 https://access.redhat.com/errata/RHSA-2025:23452 https://access.redhat.com/errata/RHSA-2025:23583 https://access.redhat.com/errata/RHSA-2025:23591 https://access.redhat.com/errata/RHSA-2025:23742 https://access.redhat.com/errata/RHSA-2025:23743 https://access.redhat.com/security/cve/CVE-2025-13947 https://bugzilla.redhat.com/show_bug.cgi?id=2418576