CVE-2026-25154mediumCWE-79

CVE-2026-25154: falha de média gravidade em localsend

LocalSend has Stored XSS in Web Share Interface via Filename

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar localsend

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.1epss 0.3%
LocalSend is a free, open-source app that allows users to share files and messages with nearby devices over their local network without needing an internet connection. In versions up to and including 1.17.0, when a user initiates a "Share via Link" session, the LocalSend application starts a local HTTP server to host the selected files. The client-side logic for this web interface is contained in `app/assets/web/main.js`. Note that at [0], the `handleFilesDisplay` function constructs the HTML for the file list by iterating over the files received from the server. Commit 8f3cec85aa29b2b13fed9b2f8e499e1ac9b0504c contains a patch.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Produtos afetados
localsend · localsend
CVEs relacionadas — localsend

No mesmo produto, das mais perigosas para as menos.

CVE-2025-27142MEDIUMLocalSend path traversal vulnerability in the file upload endpoint allows nearby devices to execute arbitrary commandsEPSS 0.5%CVE-2025-54792CRITICALLocalSend is Vulnerable to Man-in-the-Middle Attacks, Leading to File InterceptionEPSS 0.3%