« Volver al listado

CVE-2026-25154

Estado: AnalizadaMedia (6.1)—

LocalSend is a free, open-source app that allows users to share files and messages with nearby devices over their local network without needing an internet connection. In versions up to and including 1.17.0, when a user initiates a "Share via Link" session, the LocalSend application starts a local HTTP server to host the selected files. The client-side logic for this web interface is contained in `app/assets/web/main.js`. Note that at [0], the `handleFilesDisplay` function constructs the HTML for the file list by iterating over the files received from the server. Commit 8f3cec85aa29b2b13fed9b2f8e499e1ac9b0504c contains a patch.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Localsend — Localsend

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-25154",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-25154",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-02-02T16:25:11.505933Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "localsend",
          "product": "localsend",
          "versions": [
            {
              "status": "affected",
              "version": "<= 1.17.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-01-30T22:15:56.490",
  "references": [
    {
      "url": "https://github.com/localsend/localsend/commit/8f3cec85aa29b2b13fed9b2f8e499e1ac9b0504c",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/localsend/localsend/security/advisories/GHSA-34v6-52hh-x4r4",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "LocalSend is a free, open-source app that allows users to share files and messages with nearby devices over their local network without needing an internet connection. In versions up to and including 1.17.0, when a user initiates a \"Share via Link\" session, the LocalSend application starts a local HTTP server to host the selected files. The client-side logic for this web interface is contained in `app/assets/web/main.js`. Note that at [0], the `handleFilesDisplay` function constructs the HTML for the file list by iterating over the files received from the server. Commit 8f3cec85aa29b2b13fed9b2f8e499e1ac9b0504c contains a patch."
    },
    {
      "lang": "es",
      "value": "LocalSend es una aplicación gratuita y de código abierto que permite a los usuarios compartir archivos y mensajes con dispositivos cercanos a través de su red local sin necesidad de una conexión a internet. En versiones hasta la 1.17.0 inclusive, cuando un usuario inicia una sesión de 'Compartir mediante enlace', la aplicación LocalSend inicia un servidor HTTP local para alojar los archivos seleccionados. La lógica del lado del cliente para esta interfaz web está contenida en `app/assets/web/main.js`. Tenga en cuenta que en [0], la función `handleFilesDisplay` construye el HTML para la lista de archivos al iterar sobre los archivos recibidos del servidor. El commit 8f3cec85aa29b2b13fed9b2f8e499e1ac9b0504c contiene un parche."
    }
  ],
  "lastModified": "2026-06-17T10:24:12.203",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:localsend:localsend:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CC589644-2FC6-4C09-AC73-266AB31A7E1F",
              "versionEndIncluding": "1.17.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}