CVE-2025-59334 Details

A vulnerability in Linkr, a file delivery system, exists in versions through 2.0.0. The issue arises because the application does not verify the integrity or authenticity of .linkr manifest files before use. This lack of verification allows a tampered manifest to inject arbitrary file entries into a package distribution. An attacker could modify a .linkr manifest by adding a new entry with a malicious URL. When the extract command is executed, the client downloads the attacker-supplied file without any verification. This flaw enables arbitrary file injection and could lead to remote code execution if a downloaded malicious binary or script is executed.

Users should update to Linkr version 2.0.1 or later, which includes a manifest integrity check. This update ensures that the checksum of the original author-created manifest matches the one being extracted, aborting the process in case of a mismatch. If the original manifest is not hosted, the user will be warned. As a temporary measure, users can manually verify the integrity of .linkr manifests and host them on trusted servers.