Dragonfly allows arbitrary file read and write on a peer machine

Vulnerability

CVE-2025-59352 is a vulnerability in Dragonfly, an open-source P2P-based file distribution and image acceleration system. The gRPC API and HTTP APIs in versions prior to 2.1.0 do not validate or restrict file paths provided by peer requests. This allows a malicious peer to force the recipient peer to create files in arbitrary file system locations or read arbitrary files from the recipient's machine [1].

Exploitation

An attacker can operate as a peer within the Dragonfly P2P network and send specially crafted requests to other peers. No authentication is required beyond being able to connect to a peer's API endpoints. The vulnerability exists in both the gRPC and HTTP API surfaces, giving attackers multiple vectors to exploit the flaw [1].

Impact

Successful exploitation enables the attacker to steal sensitive data from the victim peer, such as credentials or cryptographic keys, by reading arbitrary files. More critically, the ability to write files to arbitrary locations allows the attacker to achieve remote code execution (RCE) on the victim's machine, for example by overwriting executable files or writing malicious scripts to startup directories [1].

Mitigation

The issue is fixed in Dragonfly version 2.1.0. Users are strongly advised to upgrade immediately. No workarounds are documented. The vulnerability has been publicly disclosed and may be exploited in the wild [1].