CVE-2025-0651

MEDIUM

File symlink abuse might lead to deleting files belonging to SYSTEM user

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2025-0651 has a selected CVSS score of 6.1 (medium).

Description

Improper Privilege Management vulnerability in Cloudflare WARP on Windows allows File Manipulation. User with a low system privileges  can create a set of symlinks inside the C:\ProgramData\Cloudflare\warp-diag-partials folder. After triggering the 'Reset all settings" option the WARP service will delete the files that the symlink was pointing to. Given the WARP service operates with System privileges this might lead to deleting files owned by the System user. This issue affects WARP: before 2024.12.492.0.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Jan 22, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

WARP

Browse Cloudflare / WARP

Default status: unaffected

CVE ListBefore 2024.12.492.0affected

References

2