Medium severity5.0NVD Advisory· Published Sep 17, 2025· Updated Jun 17, 2026
CVE-2025-35430
CVE-2025-35430
Description
CISA Thorium does not adequately validate the paths of downloaded files via 'download_ephemeral' and 'download_children'. A remote, authenticated attacker could access arbitrary files subject to file system permissions. Fixed in 1.1.2.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3Patches
Vulnerability mechanics
References
4- raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-259-01.jsonnvdVendor Advisory
- www.cve.org/CVERecordnvdThird Party Advisory
- github.com/cisagov/thorium/blob/main/api/src/utils/bounder.rsnvdProduct
- github.com/cisagov/thorium/releases/tag/1.1.2nvdRelease Notes
News mentions
0No linked articles in our index yet.