CVE-2025-24364

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Attacker with authenticated access to the vaultwarden admin panel can execute arbitrary code in the system. The attacker could then change some settings to use sendmail as mail agent but adjust the settings in such a way that it would use a shell command. It then also needed to craft a special favicon image which would have the commands embedded to run during for example sending a test email. This vulnerability is fixed in 1.33.0.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74

Affected software

No affected versions have been published.

Timeline

Published: Jan 27, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-243657.5vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Attacker can obtain owner rights o CVE-2025-243667.5SFTPGo is an open source, event-driven file transfer solution. SFTPGo supports execution of a defined set of commands via SSH. Besides a set CVE-2025-243678.8Cacti is an open source performance and fault management framework. An authenticated Cacti user can abuse graph creation and graph template CVE-2025-243687.5Cacti is an open source performance and fault management framework. Some of the data stored in automation_tree_rules.php is not thoroughly c CVE-2025-243692.3Anubis is a tool that allows administrators to protect bots against AI scrapers through bot-checking heuristics and a proof-of-work challeng CVE-2025-243709.3Django-Unicorn adds modern reactive component functionality to Django templates. Affected versions of Django-Unicorn are vulnerable to pytho CVE-2025-243717.1CometBFT is a distributed, Byzantine fault-tolerant, deterministic state machine replication engine. In the `blocksync` protocol peers send CVE-2025-243727.3CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Using a specially crafted file, a user could po CVE-2025-243736.5woocommerce-pdf-invoices-packing-slips is an extension which allows users to create, print & automatically email PDF invoices & packing slip CVE-2025-243744.3Twig is a template language for PHP. When using the ?? operator, output escaping was missing for the expression on the left side of the oper CVE-2025-243755.0Charmed MySQL K8s operator is a Charmed Operator for running MySQL on Kubernetes. Before revision 221, the method for calling a SQL DDL or p CVE-2025-243766.5kubewarden-controller is a Kubernetes controller that allows you to dynamically register Kubewarden admission policies. By design, Admission