CVE-2025-24971

CriticalRCE

Published: 04 February 2025

Published

04 February 2025

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score v4 9.5 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Score 0.1026 93.3th percentile

Risk Priority 25 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-24971 is a critical-severity OS Command Injection (CWE-78) vulnerability. Its CVSS base score is 9.5 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 6.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

DumbDrop is a minimal file-upload application that exposes a drag-and-drop interface. CVE-2025-24971 is an OS command-injection flaw (CWE-78) in the /upload/init endpoint that is reachable when Apprise notifications are enabled; the vulnerability permits unauthenticated remote attackers to execute arbitrary operating-system commands.

An attacker can supply a crafted request to the affected endpoint and obtain code execution with the privileges of the DumbDrop process, resulting in full compromise of confidentiality, integrity, and availability on the host. The CVSS 4.0 vector reflects network attack vector, low complexity, and no required user interaction or privileges.

The project’s security advisory and the referenced commit 4ff8469d state that the issue is resolved in that patch and that no workarounds exist; administrators are advised to update immediately.

EPSS for the CVE rose sharply from a low baseline to a peak of 0.4905 on 2025-12-11 before receding to the current value of 0.1026, indicating that exploitation interest materialized after public disclosure.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-3997

Vulnerability details

DumpDrop is a stupid simple file upload application that provides an interface for dragging and dropping files. An OS Command Injection vulnerability was discovered in the DumbDrop application, `/upload/init` endpoint. This vulnerability could allow an attacker to execute arbitrary code…

remotely when the **Apprise Notification** enabled. This issue has been addressed in commit `4ff8469d` and all users are advised to patch. There are no known workarounds for this vulnerability.

CWE(s): CWE-78

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1059 Command and Scripting Interpreter Execution

Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries.

attack.mitre.org →

Why these techniques?

OS command injection in public-facing web endpoint enables remote exploitation of the application (T1190) and direct execution of arbitrary OS commands via shell interpreters (T1059).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0