CVE-2020-25266

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

AppImage appimaged before 1.0.3 does not properly check whether a downloaded file is a valid appimage. For example, it will accept a crafted mp3 file that contains an appimage, and install it.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-494

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/refi64/CVE-2020-25265-25266Third Party Advisory
https://github.com/refi64/CVE-2020-25265-25266Third Party Advisory

Timeline

Published: Dec 2, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-252675.4An XSS issue exists in the question-pool file-upload preview feature in ILIAS 6.4.CVE-2020-252688.8Remote Code Execution can occur via the external news feed in ILIAS 6.4 because of incorrect parameter sanitization for Magpie RSS data.CVE-2020-252696.5An issue was discovered in InspIRCd 2 before 2.0.29 and 3 before 3.6.0. The pgsql module contains a use after free vulnerability. When combi CVE-2020-25274.1Vulnerability in the Core RDBMS component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1, 18c and 19 CVE-2020-252705.4PHPGurukul hostel-management-system 2.1 allows XSS via Guardian Name, Guardian Relation, Guardian Contact no, Address, or City.CVE-2020-252715.4PHPGurukul hospital-management-system-in-php 4.0 allows XSS via admin/patient-search.php, doctor/search.php, book-appointment.php, doctor/ap CVE-2020-252726.1In SourceCodester Online Bus Booking System 1.0, there is XSS through the name parameter in book_now.php.CVE-2020-252739.8In SourceCodester Online Bus Booking System 1.0, there is Authentication bypass on the Admin Login screen in admin.php via username or passw CVE-2020-252757.5Dovecot before 2.3.13 has Improper Input Validation in lda, lmtp, and imap, leading to an application crash via a crafted email message with CVE-2020-252767.3An issue was discovered in PrimeKey EJBCA 6.x and 7.x before 7.4.1. When using a client certificate to enroll over the EST protocol, no revo CVE-2020-252789.8An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. The Quram image codec library allows attackers CVE-2020-252799.8An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) (Exynos chipsets) software. The baseband component has a