CVE-2025-41255

Published June 25th, 2025

View on NVD ↗

CVSS v3

HIGH

CVSS v2

N/A

Affected

PROJECTS

Description

Cyberduck and Mountain Duck improperly handle TLS certificate pinning for untrusted certificates (e.g., self-signed), unnecessarily installing it to the Windows Certificate Store of the current user without any restrictions. This issue affects Cyberduck through 9.1.6 and Mountain Duck through 4.17.5.

sbaresearch/advisories

Security advisories by SBA Research.

GitHub

iterate-ch/cyberduck

Cyberduck is a libre FTP, SFTP, WebDAV, Amazon S3, Backblaze B2, Microsoft Azure & OneDrive and OpenStack Swift file transfer client for Mac and Windows.

GitHub

4.54K