CVE-2020-1904CWE-23

CVE-2020-1904: vulnerability in Facebook WhatsApp for iOS

Published · Updated

Follow this CVE+ Monitor WhatsApp+ Monitor WhatsApp Business

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 1.1%
A path validation issue in WhatsApp for iOS prior to v2.20.61 and WhatsApp Business for iOS prior to v2.20.61 could have allowed for directory traversal overwriting files when sending specially crafted docx, xlsx, and pptx files as attachments to messages.
Affected products
Facebook · WhatsApp Business for iOSFacebook · WhatsApp for iOS
Related CVEs — Facebook WhatsApp for iOS

In the same product, most dangerous first.

CVE-2019-3568CRITICALCVE-2019-3568EPSS 30.1%KEVCVE-2025-55177MEDIUMCVE-2025-55177EPSS 13.5%KEVCVE-2020-1909—CVE-2020-1909EPSS 2.3%CVE-2018-20655—CVE-2018-20655EPSS 2.2%CVE-2018-6344HIGHCVE-2018-6344EPSS 1.9%CVE-2020-1907—CVE-2020-1907EPSS 1.9%