CVE-2025-54792 Details

A critical Man-in-the-Middle (MitM) vulnerability has been identified in LocalSend versions through 1.16.1. This issue arises within the application's discovery protocol, which uses UDP multicast packets for device communication over local networks. The vulnerability allows an unauthenticated attacker to impersonate legitimate devices, intercepting, reading, and modifying file transfers between users. Exploitation of this flaw could lead to the theft of sensitive data or the injection of malware, such as ransomware, into shared files. The attack is difficult to detect and easy to execute, creating an immediate security risk.

Users can update to LocalSend version 1.17.0, which addresses the vulnerability by fixing the path traversal issue that allowed for the Man-in-the-Middle attack. The updated version is available on the LocalSend GitHub Releases page.