CVE-2026-25154

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

LocalSend is a free, open-source app that allows users to share files and messages with nearby devices over their local network without needing an internet connection. In versions up to and including 1.17.0, when a user initiates a "Share via Link" session, the LocalSend application starts a local HTTP server to host the selected files. The client-side logic for this web interface is contained in `app/assets/web/main.js`. Note that at [0], the `handleFilesDisplay` function constructs the HTML for the file list by iterating over the files received from the server. Commit 8f3cec85aa29b2b13fed9b2f8e499e1ac9b0504c contains a patch.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Jan 30, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-251557.1Qwik is a performance focused javascript framework. Prior to version 1.12.0, a typo in the regular expression within isContentType causes in CVE-2026-251566.3HotCRP is conference review software. HotCRP versions from October 2025 through January 2026 delivered documents of all types with inline Co CVE-2026-251577.5OpenClaw is a personal AI assistant. Prior to version 2026.1.29, there is an OS command injection vulnerability via the Project Root Path in CVE-2026-25167.0A vulnerability was identified in Unidocs ezPDF DRM Reader and ezPDF Reader 2.0/3.0.0.4. This affects an unknown part in the library SHFOLDE CVE-2026-251607.4Alist is a file list program that supports multiple storages, powered by Gin and Solidjs. Prior to version 3.57.0, the application disables CVE-2026-251618.8Alist is a file list program that supports multiple storages, powered by Gin and Solidjs. Prior to version 3.57.0, the application contains CVE-2026-251648.1OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, the REST AP CVE-2026-251657.8Null pointer dereference in Windows Performance Counters allows an authorized attacker to elevate privileges locally.CVE-2026-251667.8Deserialization of untrusted data in Windows System Image Manager allows an authorized attacker to execute code locally.CVE-2026-251677.4Use after free in Microsoft Brokering File System allows an unauthorized attacker to elevate privileges locally.CVE-2026-251685.5Null pointer dereference in Microsoft Graphics Component allows an unauthorized attacker to deny service locally.CVE-2026-251695.5Divide by zero in Microsoft Graphics Component allows an unauthorized attacker to deny service locally.