CVE-2025-5030 Details
Description
A vulnerability was found in Ackites KillWxapkg up to 2.4.1. It has been declared as critical. This vulnerability affects the function processFile of the file internal/unpack/unpack.go of the component wxapkg File Parser. The manipulation leads to os command injection. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used.
A critical vulnerability exists in Ackites KillWxapkg versions through 2.4.1, specifically within the wxapkg file parser component. The issue arises in the processFile function of internal/unpack/unpack.go, where improper validation of wxapkg files allows for OS command injection. This vulnerability can be exploited remotely, although the attack's complexity is considered high, requiring user interaction.
It is recommended to implement strict path sanitization when extracting wxapkg files to prevent arbitrary file write and command execution vulnerabilities.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 21, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Ackites/KillWxapkg/issues/85 | CISA-ADP | ExploitIssue TrackingVendor Advisory |
| https://github.com/Ackites/KillWxapkg/issues/85 | [email protected] | ExploitIssue TrackingVendor Advisory |
| https://github.com/Ackites/KillWxapkg/issues/85#issue-3052039180 | [email protected] | ExploitIssue TrackingVendor Advisory |
| https://vuldb.com/?ctiid.309850 | [email protected] | Permissions RequiredVDB Entry |
| https://vuldb.com/?id.309850 | [email protected] | Third Party AdvisoryVDB Entry |
| https://vuldb.com/?submit.580526 | [email protected] | ExploitThird Party AdvisoryVDB Entry |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
| CWE-77 | Improper Neutralization of Special Elements used in a Command ('Command Injection') | [email protected] |
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ackites killwxapkg | <= 2.4.1 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 20, 2025 | Initial Analysis | [email protected] |
| May 21, 2025 | CVE Modified | CISA-ADP |
| May 21, 2025 | New CVE Received | [email protected] |