Moderate severityNVD Advisory· Published Sep 17, 2025· Updated Sep 18, 2025
Dragonfly allows arbitrary file read and write on a peer machine
CVE-2025-59352
Description
Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, the gRPC API and HTTP APIs allow peers to send requests that force the recipient peer to create files in arbitrary file system locations, and to read arbitrary files. This allows peers to steal other peers’ secret data and to gain remote code execution (RCE) capabilities on the peer’s machine.This vulnerability is fixed in 2.1.0.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/dragonflyoss/dragonflyGo | < 2.1.0 | 2.1.0 |
d7y.io/dragonfly/v2Go | < 2.1.0 | 2.1.0 |
Affected products
6- ghsa-coords5 versionspkg:golang/d7y.io/dragonfly/v2pkg:golang/github.com/dragonflyoss/dragonflypkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Leap%2015.6pkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Tumbleweedpkg:rpm/suse/govulncheck-vulndb&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP6
< 2.1.0+ 4 more
- (no CPE)range: < 2.1.0
- (no CPE)range: < 2.1.0
- (no CPE)range: < 0.0.20251023T162509-150000.1.110.1
- (no CPE)range: < 0.0.20250924T192141-1.1
- (no CPE)range: < 0.0.20251023T162509-150000.1.110.1
- Range: < 2.1.0
Patches
Vulnerability mechanics
References
5- github.com/advisories/GHSA-79hx-3fp8-hj66ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2025-59352ghsaADVISORY
- github.com/dragonflyoss/dragonfly/blob/main/docs/security/dragonfly-comprehensive-report-2023.pdfghsax_refsource_MISCWEB
- github.com/dragonflyoss/dragonfly/security/advisories/GHSA-79hx-3fp8-hj66ghsax_refsource_CONFIRMWEB
- pkg.go.dev/vuln/GO-2025-3961ghsaWEB
News mentions
0No linked articles in our index yet.